Skip to content
Open vault
Blog

Frequently Asked Questions

Find answers to common questions about UnoLock. Questions are organized by category. Click any question to expand the answer.

Getting Started

What is UnoLock?

UnoLock is a sovereign digital vault that protects your most sensitive data—cryptocurrency seed phrases, documents, passwords, credentials, and more—with zero-knowledge encryption. Unlike traditional cloud storage, UnoLock cannot access your data because encryption happens on your device before anything is uploaded.

What can I store in UnoLock?

UnoLock protects any digital asset that matters to you: cryptocurrency seed phrases and private keys, passwords and credentials, sensitive documents (contracts, wills, medical records), business secrets and intellectual property, family photos and personal records, identity documents, and any file you need to keep secure and accessible.

Do I need to provide personal information to create an account?

No. UnoLock uses FIDO2/WebAuthn authentication with public-private keypairs. You do not need to provide your name, email address, or any personally identifiable information. You can create and use a vault completely anonymously.

What devices can I use UnoLock on?

UnoLock works on any modern device with a supported browser or through our Progressive Web App (PWA). This includes desktop computers (Windows, Mac, Linux), smartphones (iOS, Android), and tablets. Your vault syncs securely across all your devices.

What happens if UnoLock as a company disappears?

Your encrypted data is stored on AWS S3 infrastructure with multi-region redundancy. Even if UnoLock ceased to exist, your encrypted data would persist. With your encryption keys (which never leave your devices), you can always decrypt your data.

Security & Encryption

What is zero-knowledge encryption?

Zero-knowledge means UnoLock cannot see, access, or decrypt your data. All encryption happens on your device before data is uploaded. UnoLock servers store only encrypted blobs that are computationally indistinguishable from random noise without your keys. We have nothing to hand over even if compelled.

What encryption does UnoLock use?

UnoLock uses AES-256-GCM for symmetric encryption, which is considered quantum-safe for symmetric cryptography. For key exchange and signatures, we use post-quantum algorithms including Kyber (ML-KEM) for key encapsulation and Dilithium (ML-DSA) for digital signatures. Data is encrypted both in transit (TLS 1.3) and at rest.

What is post-quantum encryption and why does it matter?

Post-quantum encryption uses algorithms designed to resist attacks from quantum computers. Current estimates suggest quantum computers capable of breaking traditional encryption will exist within 10-15 years. Data encrypted today with classical algorithms could be harvested now and decrypted later. UnoLock's post-quantum encryption protects your data against both current and future threats.

Can UnoLock access my data if law enforcement demands it?

No. UnoLock operates a true zero-knowledge architecture. We do not possess the encryption keys needed to decrypt your data. We can only provide encrypted blobs that are useless without keys we do not have. This is not policy but mathematical reality.

Can keyloggers capture my PIN?

No. UnoLock uses a randomized visual keypad where you click positions rather than type. Since no keystrokes are involved, keyloggers cannot capture your PIN. The clicked positions are transmitted via TLS 1.3 encryption and decoded server-side using the session's unique keypad layout.

Is my biometric data sent to UnoLock?

No. Biometric data (fingerprint, face recognition) is processed entirely on your device through FIDO2/WebAuthn. UnoLock never receives, stores, or has access to your biometric information. Only the cryptographic result of successful authentication is used.

What happens if AWS is hacked?

Since all data is encrypted client-side before upload, a breach of AWS S3 would expose only encrypted blobs that cannot be decrypted without your keys. Your keys never leave your device and are never transmitted to AWS or UnoLock. A storage breach exposes nothing useful.

Features

SeedSafe

What is SeedSafe?

SeedSafe is UnoLock's feature for protecting cryptocurrency seed phrases. It uses a split-entry protocol where you enter your seed phrase in two halves across separate sessions or devices, quadruple encryption layers, and BIP-39 validation. Your seed phrase is never complete on any single device at any single moment.

Can UnoLock access my stored seed phrases?

No. SeedSafe's zero-knowledge architecture ensures seed phrases are encrypted client-side before transmission. UnoLock servers only store encrypted ciphertexts and cannot decrypt or relate the stored halves. Even UnoLock employees have no way to access your seed phrases.

Is SeedSafe compatible with all cryptocurrency wallets?

SeedSafe supports all standard BIP-39 compliant wallets with 12, 18, or 24-word mnemonic phrases. This covers virtually all modern cryptocurrency wallets including Ledger, Trezor, MetaMask, and others.

What if I lose access to one device during split-device entry?

You can complete the entry on a single trusted device. The split-device option provides enhanced security but is not mandatory for storage or retrieval.

What is LegacyLink?

LegacyLink is UnoLock's inheritance system that allows designated successors to gain access to your vault if you become incapacitated or die. Unlike traditional methods, LegacyLink activates only after a configurable period of your inactivity—your successors have no access while you remain active.

Can my heirs access my data before I die?

No. LegacyLink remains dormant while you continue accessing your vault. The inheritance trigger fires only after extended inactivity that you configure. Your heirs cannot even verify they have been designated until the conditions are met.

How do my heirs actually claim access?

After your configured inactivity period elapses, your designated successors can use the inheritance credentials you provided them (QR code, access ID, and passphrase) to claim access to your vault. No death certificates or legal proceedings are required.

Can I change my designated heirs?

Yes. You can modify your heirs and the inheritance configuration at any time while you have vault access. Changes take effect immediately.

DuressDecoy

What is DuressDecoy?

DuressDecoy is the safeword response in the Sovereign tier. You mark selected Spaces as sensitive and set a safeword PIN distinct from your normal PIN. If you are forced to provide access, entering the safeword PIN opens the same Safe with the sensitive Spaces hidden, while non-sensitive Spaces remain available. The attacker sees only what you chose to leave visible.

Can UnoLock detect when I use the safeword PIN?

Yes. The server recognizes safeword authentication; that is how it restricts the session's view to non-sensitive Spaces. Your Safe's contents remain encrypted and unreadable to UnoLock. The safeword is not a silent alarm and does not guarantee safety under coercion: an adversary who already knows your Safe's contents may have information outside the safeword session.

How is DuressDecoy different from LifeSafe?

DuressDecoy is the safeword response in Sovereign: entering the safeword PIN hides the Spaces you have marked as sensitive. LifeSafe is the safeword response in HighRisk: entering the safeword PIN permanently deletes those marked Spaces. Non-sensitive Spaces remain available in both. Choose based on whether you want the marked data to remain hidden and recoverable (DuressDecoy) or permanently destroyed (LifeSafe).

What if I accidentally enter the safeword PIN?

In Sovereign, the sensitive Spaces are hidden, not deleted. Log out and open the Safe with your normal PIN to see them again. In HighRisk, the safeword PIN permanently deletes the marked sensitive Spaces and UnoLock cannot restore them, so choose your safeword carefully and keep independent backups of anything you cannot afford to lose.

TimeLock

What is TimeLock?

TimeLock allows you to make your vault completely inaccessible for a defined period. Once activated, the lock cannot be shortened or overridden—even by you. This protects against coercion during high-risk periods like border crossings.

Can the TimeLock period be changed after activation?

No. Once TimeLock is set, the period is immutable and cannot be altered. This is the entire point—security that you could disable under pressure would provide no protection against pressure.

What happens if I need access during a TimeLock?

You must wait until the period expires. The immutability is essential to TimeLock's protective value. Plan your TimeLock durations carefully based on your actual needs.

Spaces

What are Spaces?

Spaces allow you to partition your vault into isolated environments with separate keyrings and permissions. Different Spaces can have different access controls (read-only vs admin).

Can someone with access to one Space see other Spaces?

No. Each Space is completely isolated. Users granted access to one Space cannot see, access, or even know that other Spaces exist unless specifically authorized.

Can I have different inheritance rules for different Spaces?

No. LegacyLink is configured for the whole Safe through LockoutGuard, and a successor who recovers through it takes custody of the Safe. Spaces help you organize what your successor will find, for example by keeping estate records, crypto notes, and family documents in separate, clearly labeled Spaces.

Vault Messaging

What is Vault Messaging?

Vault Messaging is UnoLock's zero-knowledge, address-based system for moving messages and files into a Safe. It is not a chat app: messages are sent to Receive Addresses rather than to identities. Each Receive Address has its own keypair and its own limits on attachments, usage count, and throttling, and can be disabled without affecting other addresses. External senders can use UnoLock Drop without creating a Safe. Message payloads are encrypted end-to-end and decrypted only inside the recipient's Safe.

Can UnoLock read or track Vault Messaging messages?

UnoLock cannot read them. Payloads are protected with post-quantum encryption (ML-KEM-1024 and AES-256-GCM) and decrypted only inside the recipient's Safe. The design minimizes metadata: Receive Addresses are hashed on your device, so the servers route encrypted payloads and see only hashed addresses, and separate addresses keep conversations compartmentalized.

Privacy & Anonymity

Does UnoLock collect any personal information?

No. UnoLock does not collect, store, or process any personally identifiable information. Your vault is identified by cryptographic keys, not personal details. You can use UnoLock completely anonymously.

Does UnoLock use cookies or track my activities?

No. UnoLock avoids cookies, local storage, and server-side metadata. We use encrypted, stateless sessions that prevent tracking or linking of user activities. No session data remains on your device after logout.

Can I pay anonymously?

Yes. UnoLock accepts Bitcoin payments that do not require personal information. For users who prefer traditional payments, Stripe is available but decoupled from vault identity.

Can I use UnoLock in countries with strict surveillance?

Yes. UnoLock's anonymous account creation, zero-knowledge architecture, and lack of personal data collection make it suitable for use in high-surveillance environments. Your identity remains protected even under hostile conditions.

Is it safe to use UnoLock on a public computer?

Yes. The absence of local storage and cookies ensures that no session data, keys, or vault information remains on the device after you log out. However, be aware of physical surveillance (shoulder surfing) and potential keyloggers on public machines.

Recovery & Access

What happens if I lose my device?

If you have LockoutGuard configured, you can recover access through your configured recovery methods (backup codes, secondary FIDO2 devices, or other authentication you set up in advance). You can also disable the lost device's access from another trusted device using TimeLock.

What happens if I forget my PIN?

If your primary PIN is forgotten, LockoutGuard recovery options can restore access if you configured them in advance. The recovery process uses multi-factor authentication to verify your identity securely.

What if I lose all my recovery keys?

If all recovery options are lost, access may be permanently unrecoverable due to UnoLock's zero-knowledge model. This emphasizes the importance of securely storing backup authentication methods. UnoLock cannot recover your access because we do not have your keys.

Can I access my vault from multiple devices simultaneously?

Yes. You can access your vault from multiple registered devices, and all changes sync securely in real-time across platforms.

What happens if I stop paying for my subscription?

Your Safe remains funded until its displayed expiry date. Cancelling or stopping payment does not refund used service, and expiry is not a lossless conversion: the expiry flow can delete cloud files, so keep the Safe funded and keep independent backups. If you prefer not to subscribe, you can buy one-time prepaid credits to extend your Safe's time.

Pricing & Tiers

What tiers does UnoLock offer?

New Safes choose Sovereign or HighRisk. Both have the same price: a US$30 base yearly cost (US$2.50 per month equivalent), with 1 GB of cloud storage and 2 access keys included, and up to 10 access keys. Extra storage is US$1 per GB per month and extra access keys are US$2 per key per month. LegacyLink inheritance, LockoutGuard, Spaces, and Vault Messaging are available in both tiers.

What is the difference between Sovereign and HighRisk tiers?

The only difference is what the safeword PIN does to Spaces you have marked as sensitive. Sovereign hides them (DuressDecoy), so they can be shown again with normal access. HighRisk permanently deletes them (LifeSafe), for users facing more extreme threat scenarios. Price, storage, and access-key allowances are the same.

Can I upgrade or downgrade my tier?

Yes. You choose Sovereign or HighRisk when you buy your Safe, and you can switch between them later in either direction. Both tiers have the same rates and allowances, so switching only changes your safeword response. Read the confirmation carefully: while your Safe is on HighRisk, the safeword PIN permanently deletes marked sensitive Spaces.

Can I prepay for Safe time?

Yes. You can buy one-time credits with a card or Bitcoin to extend your Safe's expiry without an automatic subscription. Credits are applied at the base rate plus any extra storage and access keys, so more usage can shorten the time they cover. Prepayment buys time, not perpetual access: monitor the expiry date and renew before it.

Technical Questions

What is a client-side keyring?

A client-side keyring is a secure, local repository on your device that stores and manages your cryptographic keys. Keys are generated locally, stored encrypted on your device, and never transmitted to UnoLock servers.

What is FIDO2/WebAuthn authentication?

FIDO2/WebAuthn is a passwordless authentication standard using public-key cryptography. Only the private key stored on your device can authenticate. This prevents phishing, credential stuffing, and man-in-the-middle attacks because there are no passwords to steal.

What is perfect forward secrecy?

Perfect forward secrecy ensures that each session uses unique encryption keys. Even if a future key is compromised, past sessions remain secure because they used different keys that no longer exist.

How does multi-region redundancy work?

Your encrypted data is replicated across multiple AWS regions globally. If one region experiences an outage, your data remains accessible from other regions. All copies are encrypted with your keys that never leave your devices.

Does UnoLock work offline?

UnoLock requires network connectivity to sync with cloud storage and verify authentication. However, the actual encryption and decryption of your data occurs entirely on your device (client-side).

Is UnoLock compliant with GDPR and HIPAA?

UnoLock's zero-knowledge architecture supports compliance with GDPR, HIPAA, and other privacy regulations by ensuring that sensitive data remains encrypted and inaccessible to anyone except the authorized user. We do not collect or process personal data.

Can governments force UnoLock to hand over my data?

Governments can make legal demands, but UnoLock can only provide encrypted data we cannot decrypt. We do not possess your encryption keys and have no mechanism to access your plaintext data. This is architectural reality, not policy.

Does UnoLock keep logs of my activities?

UnoLock does not log user activities or vault access patterns. Server-side logs for infrastructure operations (required for system maintenance) contain no user-identifiable information due to our anonymous, zero-knowledge architecture.

Still Have Questions?

If your question is not answered here:

Back to Home