Trust your phone,
not your laptop.

It will be, fully. Every component - mobile app, browser extension, relay server, desktop agent - is MIT-licensed, and the complete repository goes public at launch. Until then the cryptographic design is documented on this site; nothing in the security model depends on the code staying private.

On your phone. The vault is encrypted with AES-256-GCM using a key derived from your master phrase via Argon2id. It never leaves the device in plaintext, and there is no cloud account behind it.

We don't - and that's deliberate. The Apex relay never sees your passwords or vault contents (they are end-to-end encrypted between your devices), but it does observe metadata: which devices connect, when, and roughly how large each ciphertext is. Calling that "zero-knowledge" would overstate it. We say "end-to-end encrypted" and "content-blind relay" because those are accurate.

Yes. Apex Relay is built for self-hosting and ships as a Docker image at launch. Point your devices at your own instance and you don't have to trust ours - or anyone's - for routing. Both modes are content-blind by construction.

Yes. The vault opens without internet. Browser autofill works over local LAN when both devices are on the same network, so airplane mode and dead Wi-Fi don't block you.

Without a backup, the vault is gone - there is no escrow and no backdoor. If we could recover it, so could anyone who compromised us. You can opt in to an encrypted backup (see the Cold Vault Protocol) and store it wherever you want; we never hold one for you by default.

Those services keep an encrypted blob of your vault on their servers by default. Even with strong encryption, a breach puts that blob in attackers' hands to grind on offline. Apex doesn't upload your vault at all - backups are optional, encrypted client-side, and stored only where you choose. The trade-off: pairing and recovery are your responsibility, not a cloud account's.

It removes the most valuable targets from reach. Malware that lands on your computer - a malicious npm/PyPI package, a trojaned app, an info-stealer - runs with your privileges and copies whatever it can find: browser-saved passwords, SSH and GPG keys, .env files, and password-manager vault files. With Apex, the vault is never on the computer and (with Apex Agent) neither are your SSH/GPG keys, so there is no vault file to copy and no master password to keylog. The worst case shrinks from "the attacker has everything" to "the attacker may have seen the one credential you were actively using." We don't claim to make a compromised machine safe - other local secrets you keep there are still yours to defend - but your crown-jewel secrets aren't there to steal.

Apex Portal detects a login form and sends an encrypted request to your phone. You approve with biometrics. One credential travels back end-to-end encrypted, decrypts in the browser tab's memory, fills the field, and is wiped on submit. The browser never holds your vault.

That's what Apex Agent (coming soon) is for. It speaks the SSH and GPG agent protocols on your desktop, but the private keys live exclusively on your phone - never written to ~/.ssh or ~/.gnupg. Every signature requires a biometric tap, so a stolen or compromised laptop can't exfiltrate your keys, can't push to GitHub as you, can't sign a release, and can't log into your servers. Revoke a lost machine by un-pairing it; the keys were never on it.