The first encrypted vault designed to survive quantum computers. Drop it in any cloud — unlock it from every device you own.
Today's encryption breaks the moment a quantum computer arrives. Sigillum is already immune. Same vault format on macOS, Android, iOS and Linux. No accounts. No telemetry. No ads.
ML-KEM-768 ML-DSA-65 AES-256-GCM-SIV FIPS 203 & 204
Post-quantum encryption · Built for the next 30 years and forever
Q-Day is the moment a quantum computer can break the RSA / elliptic-curve cryptography that protects essentially every encrypted file in every cloud you've ever used. Estimates for when it arrives have collapsed sharply in the last two years:
Google Quantum AI's lead Hartmut Neven stated in early 2025 that “commercial applications” of quantum computing are around 5 years away — an aggressive revision of the 15–20-year estimates that dominated the field as recently as 2023.
Source: Reuters, January 2025 (“Alphabet's Google touts quantum chip ‘Willow’”)
Cryptographer Michele Mosca formalised the migration deadline: if the time you need your data to stay secret plus the time to migrate exceeds the time until Q-Day, you are already too late. For most users that math points to migrating to post-quantum encryption now.
Source: Mosca, “Cybersecurity in an Era with Quantum Computers” (IEEE S&P, 2018)
In August 2024 NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 — the first formal post-quantum cryptographic standards. They did not standardise out of caution; they standardised because the threat is now inside engineering planning horizons.
Source: NIST CSRC, August 2024
Anyone with the budget and the patience is already archiving today’s encrypted traffic, knowing they cannot read it yet. The list of parties who would pay good money to read your secrets 10 years from now — and who can afford to wait that long — is much longer than the conversation usually admits:
Multiple public disclosures over the last decade have made it clear that bulk traffic collection at scale is no longer hypothetical. Treat the specifics of any one leak with the caution they deserve; treat the strategic posture they revealed as confirmed. The only question is which categories above already touched your data, and which will get around to it next year.
Every file you ever uploaded to a cloud, a corporate SharePoint, a medical-records portal, or any TLS connection — if it travelled with classical key exchange and sat on a disk wrapped in plain AES — is already somewhere in somebody’s archive. Your seed phrases. Your medical history. Your passport scans. Your private messages. All of it.
There is no patch coming for RSA. There is no firmware update for elliptic-curve. The only fix is to re-wrap your data with a post-quantum cipher before it goes back into any cloud — today, while the quantum hardware is still being built. That is exactly what Sigillum does.
Files you put in iCloud, Dropbox or Drive right now are already being archived by adversaries who expect to crack them later. The strategy is called "harvest now, decrypt later" — and AES-only wrappers, plus the RSA / elliptic-curve key exchanges every other product on the market uses, are exactly what they are betting on.
Sigillum wraps every vault key with a hybrid X25519 + ML-KEM-768 KEM and signs its config with ML-DSA-65 — the two lattice-based algorithms that NIST standardised in 2024 (FIPS 203, FIPS 204). A quantum computer can break the X25519 half. It cannot break ML-KEM. The vault stays sealed.
Sigillum doesn’t bolt encryption onto a desktop filesystem; it was designed from day one for object storage and distributed sync. Every property below is why your vault ends up cheaper, faster, and safer in any cloud than every other encrypted-disk product on the market.
Every file in a Sigillum vault is its own self-contained ciphertext blob. No single “disk image” that has to be re-uploaded in full when one byte changes. Sync engines (rclone, NextCloud client, Proton Drive) transfer only the files that actually changed.
Filenames in the cloud are deterministic HMAC output of the plaintext name — not encrypted ciphertext, not a blind random handle. Same name → same sealed path, every time. Sync engines can dedupe, version, and resume by name without ever learning what the file is.
This is a narrow but real homomorphic property over equality: your sync engine is doing useful computation on the sealed data (matching identical blobs across replicas) without decrypting a byte. Full homomorphic encryption — arbitrary computation on ciphertext — is the long-game research direction; Sigillum captures the practical benefit for the exact operation sync needs today.
Every block write is a full-blob PUT. No partial writes, no rsync deltas, no torn updates from a half-uploaded change. Compatible with the strict write semantics every modern object store offers — not just POSIX filesystems.
Sigillum's filesystem layer holds locks locally for safety, not across the network. Multiple devices can read the same vault in parallel; coordinated writes use short-lived per-file leases that work over any storage that supports conditional PUTs.
Large files split into fixed-size blocks (default 64 KiB). A 4 GB video updates one block on edit, not the whole file. Cloud cost scales with real changes, not file size.
Roadmap: native S3 / R2 / Backblaze B2 backends talking directly to the storage API. Skip the cloud-app middleware entirely. For users running their own NextCloud or MinIO this is the cheapest private vault stack in the industry.
Sigillum is the right answer when you have data you need to keep and need to keep secret — and you want it on every device you own, without trusting a third party with the keys.
The single hardest "where do I put this" problem in crypto. Paper backups burn. Hardware wallets die. A Sigillum vault on three independent clouds survives any one provider going down; the seed phrase is post-quantum-sealed against the day quantum computers can derive private keys from public addresses.
Scans of your passport, driving licence, residence permit, vaccination records, insurance cards. Available on every phone you carry, sealed so a phone theft doesn't leak your identity.
Family albums. Medical images. Anything you would not want a cloud-provider employee or a Google Photos ML pipeline to index. Sigillum's block encryption lets you keep the convenience of cloud-backed photos without the surveillance tax.
Obsidian and Logseq vaults; encrypted journals; encrypted databases of passwords-the-password- manager-doesn't-handle (recovery questions, account PINs, safe combinations). The Sigillum Sync Obsidian plugin (coming Q3 2026) drops a sync layer onto any Obsidian vault using Sigillum as the encrypted backing.
Lab results, prescription history, contracts, powers of attorney, scanned wills. Things you need instantly when something goes wrong, but absolutely cannot have leaked. Sigillum's zero-knowledge posture means a server breach reveals nothing.
Customer contracts, supplier prices, source code for unreleased products, accounting exports. Enterprise tools start at €15/user/month; Sigillum is a one-off purchase and works on the cloud accounts you already pay for.
One vault format, every platform. Pick yours below. Sigillum is published exclusively through the official app stores — no sideloading, no unsigned binaries, no “mirror” downloads.
Locking distribution to the App Store and Google Play isn’t ceremony. It is the only way to guarantee that the binary on your device is the one we wrote and the one Apple or Google audited and signed. A tampered “Sigillum” downloaded from a random mirror could silently exfiltrate your passwords, capture biometric prompts, or behave like Pegasus-class spyware against the very user it’s supposed to protect — and you would have no way to tell.
The official stores refuse to publish a build whose signing key doesn’t match the developer’s registered identity, run automated and human review on every release, and pull the app the moment a verified compromise is found. We rely on that chain. We don’t compete with it. Anything offering Sigillum from anywhere else is not Sigillum.
Native SwiftUI app. Mounts vaults as Finder volumes so every app you already use just opens encrypted files like normal ones.
Mac App Store official channel onlySAF-first file browser, vault DocumentsProvider, share target, launcher quick-note. No Play Services dependency — runs on GrapheneOS too.
Google Play official channel onlyFile Provider extension surfaces vaults in the Files app. Share Extension for capturing into a vault. iCloud Drive as the cross-device sync layer.
App Store coming Q3 2026Command-line and desktop integration. Same vault format as every other platform — mount a vault you created on your phone with a single command.
Linux build coming Q3 2026Browser extension to open a published Sigillum vault from any URL. No native app, no install dance for the recipient — paste the URL, paste the config, browse the files inside the browser.
Add to browser coming Q3 2026Sigillum doesn’t host anything — that’s the point. Your vault is a directory of opaque, sealed blobs; anywhere that holds files can hold a Sigillum vault. The categories below cover the common ones, but the list is not exhaustive — if your storage exposes a file path or a URL, Sigillum can use it.
Often paired with Sigillum — end-to-end encryption on both sides.
The boxes everyone already pays for.
For users who don’t want a third party in the loop at all.
Tier 0 storage for serious workloads. The cheapest per-GB the industry has.
If a path mounts as a folder, it works.
When even “your own cloud” is too much surface area.
For the data you want pinned to a network nobody owns.
Yes — you can host your encrypted vault on a plain web server.
Your encrypted vault is a directory of opaque blobs. Once it’s sealed, you can host it anywhere — including a plain public web server — and only the people you give the config file and the passwords to can read a single byte of it. Everyone else sees noise.
Drop the vault folder on GitHub Pages, Cloudflare Pages, your own blog, an S3 static site. Send your friend the URL. Send them, separately, the small config file and the password. They unlock it in Sigillum or in the upcoming browser plugin and browse the files like a normal folder.
The URL is public; whoever runs the web server sees an IP fetching encrypted blobs. This is not a dark-web replacement, and you should not treat it as one. What it gives you is something different and more useful for most people: the data itself is unreadable to everyone except your invited recipients. No Tor, no special protocol, no risk of being flagged as “a Tor user”.
Hand the config + passwords to your recipient through a channel different from the one the vault lives on. A phone call. A face-to-face meeting. A separate end-to-end-encrypted messenger. The two halves cross-check each other — a leak of one is useless without the other.
Family photo albums you don’t want indexed by ML pipelines. Long-form journalism source material. Whistle-blower archives. Legal-discovery bundles. Wedding photos for the guest list. Anything where the recipient list is small and known, and the underlying files are too big or too sensitive for email.
Coming Q3 2026: a Sigillum browser plugin (Firefox + Chrome / Brave / Edge) so your recipient doesn’t even have to install an app — they click the plugin, paste the URL + config, and browse your vault inside the browser itself. HTML files open in a tab; everything else downloads the way the browser already handles it.
Hybrid X25519 + ML-KEM-768 key wrap, ML-DSA-65 config signatures, AES-256-GCM-SIV or XChaCha20-Poly1305 AEAD. The lattice algorithms are NIST-standardised (FIPS 203 / 204) and already deployed in Signal, WhatsApp, iMessage and TLS 1.3.
Identical binary format across macOS, Android, iOS and Linux. Create on Android, mount on macOS, edit on Linux — no migration, no re-encryption, no proprietary lock-in.
Privacy-aligned drives, mainstream consumer clouds, self-hosted NextCloud, enterprise S3-class object storage, plain WebDAV / SMB / NFS / SFTP, local SSDs, tape, optical media, decentralised IPFS / Arweave — or a plain public web server. Sigillum stays out of the sync business and out of your wallet for storage.
No sign-up flow. No analytics SDKs. No crash reporting. No ad networks. The app makes no network calls on its own — only the cloud apps you choose to use.
No Play Services dependency. Runs cleanly on GrapheneOS, LineageOS and /e/OS. The Android cloud picker uses the system's SAF, so you reuse whichever cloud apps you already trust.
Sigillum doesn’t depend on Proton, Apple, Google or anyone else. Your encrypted blobs back up freely to any cloud you trust — including Proton Drive, plus three others as belt-and-braces redundancy — without any “bridge” app or vendor lock-in.
The very thing that protects your data from cloud breaches, government subpoenas, and rogue insiders is the same thing that protects it from us. Sigillum has no “forgot password” link — because if we did, anyone who compromised us would have one too. That is the feature you are paying for.
The trade-off is honest: lose your unlock material and the data is gone. Three habits make that essentially a non-issue.
If you lose your FS password and your config password and your TOTP secret (if enrolled) and your config file and your recovery shares, your data is gone. We cannot help — because nothing on our side ever held the keys. That is the entire pitch.
Every byte of your data is encrypted on your phone, your Mac, your laptop — before it touches any cloud. The keys that turn ciphertext back into files exist only in your device’s secure enclave and in your head. EINIX has no copy. Apple, Google, Proton, Dropbox have no copy. No government can subpoena a copy — because there is no copy to subpoena.
“Zero-knowledge” is a word everyone in this industry uses; almost nobody backs it with math. Here is the math.
Your password is run through Argon2id, the winner of the 2015 Password Hashing Competition. It is memory-hard: every guess costs hundreds of megabytes of RAM. A bank of 10,000 GPUs that cracks SHA-256 passwords in seconds takes centuries on Argon2id. The parameters are tunable per-vault — pick the threat model you actually have.
Why it’s safe: brute-force attacks scale with money. Argon2id makes the money line vertical.
The vault’s master key is wrapped under a hybrid of two key-exchange algorithms combined through an IETF SHAKE-256 KEM combiner. X25519 (the elliptic-curve standard inside TLS 1.3) covers today; ML-KEM-768 (Kyber, FIPS 203, NIST-standardised August 2024) covers tomorrow.
Why it’s unbreakable: to read the vault, an attacker has to break both algorithms. A quantum computer breaks X25519 the day it arrives, but cannot break ML-KEM. A future cryptanalytic break of ML-KEM still leaves X25519 standing. The attacker needs both holes at once. Nobody plans for both.
The vault’s config blob is signed with ML-DSA-65 (Dilithium, FIPS 204) — the lattice-based digital-signature standard NIST finalised alongside ML-KEM. If anyone edits a byte of your config — cloud provider, malware, a rogue admin — the signature breaks and your device refuses to open the vault.
Why it’s safe: the cloud cannot lie to you about your own vault. A modified config is a refused config.
Every block of every file is sealed with AES-256-GCM-SIV (RFC 8452) — the nonce-misuse-resistant cousin of the AES-GCM you already trust inside TLS. If two blocks accidentally use the same nonce, GCM leaks the plaintext; GCM-SIV does not. Belt-and-braces against implementation bugs.
Why it’s safe: even a buggy nonce generator cannot reveal what you wrote. The only failure mode is “you cannot decrypt”; never “the attacker can.”
On ARM cores without AES hardware acceleration, Sigillum can switch to XChaCha20-Poly1305 — the same AEAD WireGuard and TLS 1.3 fall back to. Stream-cipher speed, same 256-bit security level.
Why it’s safe: identical security guarantee, picked at vault creation, never silently degraded.
Filenames in the cloud are deterministic HMAC-SHA-256 output of the plaintext name under a per-vault key — not encrypted ciphertext. Same plaintext name → same blob path, every time. Sync engines (rclone, NextCloud client, Proton Drive) can dedupe, version and resume by name without ever learning what the file is.
Why it’s safe: sync stays fast and incremental; the cloud sees opaque digest strings it cannot reverse.
If somebody breaks into our office tomorrow and walks out with every disk we own, every laptop, every backup tape — they will not learn a single byte of your data. Because nothing on our side ever held the keys. That is what zero-knowledge means when you back it with math.
| Key wrap | X25519 + ML-KEM-768 hybrid via IETF SHAKE-256 KEM combiner |
|---|---|
| Signatures | ML-DSA-65 (FIPS 204) over the vault config |
| Block AEAD | AES-256-GCM-SIV (default) or XChaCha20-Poly1305 |
| Filenames | HMAC-name-sealed with a per-vault key; IV-chained directory tree |
| Local key storage | Android Keystore (class 3 biometric) / iOS Secure Enclave / macOS Keychain |
| At-rest layout | Per-block IV; key-committing AEAD; xattr name + value sealing |
| Memory handling | Every secret zeroed on drop; mlocked when permitted |
| Telemetry | None. The app proper makes no network calls |
Vulnerability reports go through the in-app “Report a security issue” menu and the community forum (coming soon). 90-day disclosure window.
Your vault's .cbor config blob —
the small piece without which the vault is
unrecoverable — gets a redundant copy pinned
to decentralised storage (IPFS via Filecoin or
Arweave). One cloud provider goes down, one
password manager loses your master entry, one
laptop falls in a lake — the config is
still there, anchored on a network nobody owns.
On top of Sigillum's existing X25519 + ML-KEM-768 wrap, Pro adds a second independent ML-KEM-1024 seal with its own keypair stored separately. If a future cryptanalytic break compromises one parameter set, the other still holds. Defence in depth against the unknown.
Shamir-secret-shared recovery keys distributed across trusted contacts; M-of-N reconstruction without anyone seeing more than their slice.
Every vault operation signed and chained, so you can prove (or detect) whether the vault was opened while you were away. The kind of feature lawyers, journalists, and political dissidents need; the kind that costs $10k/user/month from enterprise vendors.
FUSE 2/3 mount, headless CLI for servers, GNOME & KDE file-manager integration, AppImage + .deb + Flatpak.
Native app, File Provider extension, Share extension, iCloud Drive sync. Same vault format as every other platform.
Drop-in replacement for Obsidian Sync ($10/month) using a Sigillum vault as the encrypted backing — you keep the convenience, lose the subscription, gain post-quantum encryption.
Lightweight browser extensions for Firefox and any Chromium browser (Chrome, Brave, Edge, Arc, Vivaldi). Paste a vault URL, drop in the config file, and browse a published Sigillum vault inside the browser — HTML files open in a tab, everything else downloads as the browser normally would. The recipient side of the “publish openly, share privately” pattern.
Optional first-party cloud for users who’d rather not pick a provider — zero-knowledge by construction. Strictly opt-in; the bring-your-own-cloud model stays free forever.
Core encrypted-vault use stays free. Multi-device sync orchestration, automated cloud-mirror backups, team-shared vaults move under the paid plan as the project matures.