End-to-end encryption
Turn it on and the sensitive parts of your records are encrypted on your device before they reach us. What it covers, the recovery key, sharing, and what cannot be undone.
Encryption is optional, per account, and it changes one thing fundamentally: with it on, Storehouses cannot read the sensitive fields of your records. They are encrypted on your own device under a key only you hold; the server stores ciphertext and sealed copies of keys, never a usable key.
What is encrypted
The descriptive text that identifies what you own: titles, descriptions, private notes, sellers, serial and reference numbers, provenance and the equivalent fields in every category, plus collection and location names and notes, and the estate plan's instructions.
Numbers and structure stay readable so the product keeps working: values, quantities, dates, categories and the links between records. Totals, charts, filters and alerts all work on an encrypted account. Photographs and documents are protected by access control rather than client-side encryption. Sample assets are never encrypted.
Turning it on
Account → Security → Encryption
Read the warning. It is the one place in the product where a mistake is unrecoverable.
Your recovery key
A 71-character code, shown once. Write it down or store it in a password manager. It is the only way back in if you forget your password.
Your device does the work
Existing records are fetched, encrypted on the device, and written back. Other devices signed in to the account are told the key changed and ask you to unlock.
Unlocking
Your password unlocks the account key. On phones and desktops the unlocked key is kept in the device's own keychain, so daily use never asks again; in a browser it lives only for the session. Switching between accounts you belong to does not re-ask — one unlock opens every encrypted account that has shared its key with you.
Passwords and recovery
- Changing your password re-seals the key under the new one. The recovery key stays valid.
- Forgot your password — reset it by email as usual, then unlock with your recovery key and set a new password.
- Regenerate the recovery key from Account → Security at any time; the old one stops working.
- Lost both? The encrypted fields cannot be recovered — by you, by us, by anyone. The rest of the record (values, categories, photographs, documents) remains.
Sharing without weakening it
Every person has a key pair. When you give someone access — a member, a connected firm, an heir whose access has opened — your device seals a copy of the account key to their public key; only their own password can open it. Removing them deletes that copy. A share link carries its own key inside the link, never sent to a server. See People and roles and Share links.
Members of an encrypted account need their own Storehouses login with encryption set up before a key can be shared with them; the app walks them through it when they accept.
Rotating and turning off
Rotate key re-encrypts every record under a new key and re-seals every copy, in a two-phase process that either completes or leaves everything as it was. It invalidates outstanding share links. Turn off decrypts everything on your device and writes it back in plain form.
What it protects against, honestly
A copy of our database or key store, a staff member with raw access, a compromised backup: ciphertext. It does not protect against someone who has your password or recovery key, or a compromised device. Two-step verification and app lock exist for those.
Share links
A link to a collection or an asset, for someone who does not need an account: password, expiry, view limit, read-only or editable.
App lock, sessions and the security log
Lock instead of signing out, two-step verification, every device signed in, sign out everywhere, and the record of what happened to your login.