01 / Aevoris Cloud
The cloud that cannot read you.
Aevoris builds family software where the operator is mathematically incapable of seeing your data. Documents, credentials, locations — sealed on your devices, opened only by your family.
Not policy. Physics.
- Envelope
- 553 bytes
- an SOS and a check-in are identical
- Plaintext on our servers
- 0 rows
- by construction, not by policy
- Keys we hold
- None
- made on your devices, kept there
Every privacy policy is a promise.
Promises can be broken. Mathematics cannot.
Aevoris runs on the second kind.
03 / The principle
Locked before it leaves your hands
Locked on your device.
Before anything leaves your hands it is locked. The key is made on your device and never leaves your family — we never hold a copy, so there is never one to hand over.
It travels unreadable.
An SOS and a routine check-in are the same 553 bytes on the wire. Even the shape of your life is hidden: a cry for help is indistinguishable from silence.
Opened only by your family.
On arrival, only a device that belongs to your family holds the key that opens it. Not us. Not a subpoena to us. No one.
04 / Product I
Vault For Us
Your family's papers and passwords, in a vault only your family can open.
- Passkey sign-in, no passwords anywhereWebAuthn passkeys are the only way in. A new device is enrolled by your family in person — never by a reset email an attacker can intercept.
- Credentials vault with hardware-key unlockBanking logins, card PINs, and recovery codes open only with your passkey physically present. Each record is envelope-encrypted, so you choose exactly who in the family can see it.
- Encrypted drive with private OCRScan passports, deeds, and prescriptions, then search them by their text. OCR runs in your own browser — the plaintext never leaves your device, not even to us.
- Per-record sharing and member permissionsModule by module, record by record: parents see everything, teenagers see their own documents, grandparents see what they need.
- The paper passkeyA printed recovery kit that restores the whole vault after every device is lost, stolen, or dead. Keep it in a drawer; it never touches a server in plaintext.
- Immutable backups with an integrity monitorObject-locked encrypted copies that ransomware cannot rewrite, checked continuously for silent corruption. Reminders can reach you on WhatsApp — opt-in, off by default.
Visit vaultforus.com
Six capabilities · six faces
05 / Product II
FamilySecure
Know they're safe. Without anyone else knowing anything.
- Live family map and presence boardEveryone who matters on one quiet map, with an at-a-glance board of who is where — rendered only on family devices, never on a server.
- SOS and check-in, held to 553 bytesA cry for help travels in the exact same envelope as a routine check-in. Anyone watching the wire — including us — sees identical bytes.
- Places and arrival alertsHome, school, practice — geofenced arrivals and departures, computed from a place vault that is named on your devices and sealed everywhere else.
- Escort mode with stall detectionA late walk is watched with the screen off; if the journey stalls, the family knows. Shared for exactly as long as it lasts, then sealed again.
- A precision dial and quiet hoursEach person tunes how precisely they are seen, per circle, and when — teenagers earn autonomy on a schedule the whole family can read.
- Guest passes and a recovery codeSitters and grandparents get limited, expiring access. A lost phone is restored from a recovery code — same identity, same safety numbers, no session needed.
Visit familysecure.com
Ciphertext on every wire
06 / The ledger
Claims we can prove
Every number below comes out of a suite that runs on every commit. When the code opens with the beta you will be able to run it yourself, and the questions we have not answered open with it.
- 3,406
- core tests over the crypto engine and the wire formats
- 2 × 1,409
- byte-identical conformance checks — Swift and Kotlin held to the TypeScript reference
- 80
- SQL assertions proving one family can never read another
- 553
- bytes in every event envelope — an SOS and a check-in are the same size
- 0
- plaintext rows on any server, by construction
And a record of what we haven't proven yet. We would rather be checkable than impressive, so it opens with the code. Until it does, ask and we will send it.
Ask for the honesty ledger →Not proof. Just true.
Numbers that prove nothing
None of this makes your data safer. It is what is in the repository, counted. No hours, no dates, nothing about how hard anyone worked. Check the code out and you will get the same answers.
- features151,640
- lib129,808
- app61,315
- components23,631
- db5,028
- 371,862
- lines of TypeScript, across 2,367 files.
- 100,944
- of those lines are tests. Twenty-seven per cent of the codebase exists to check the rest of it.
- 6,961
- unit and integration cases, declared across 710 files.
- 988
- end-to-end cases, across 21 Playwright specifications.
- 554
- React component files.
- 392
- API route handlers behind 145 pages.
- 161
- tables in the schema.
- 208
- row-level-security policies standing on those tables.
- 192
- migrations to get there, and 7,513 lines of SQL.
- 4,978
- lines in the largest file in the repository. It is the schema.
- 457
- Zod schemas guarding the boundaries where data arrives.
- 1,488
- exported TypeScript types.
- 6
- cryptographic primitives in the engine: AES-GCM, Argon2id, Ed25519, HKDF, HMAC, SHA-256.
- 1
- stylesheet in the whole application, 1,935 lines of it.
- 37
- direct dependencies. Fifty-five counting the ones that never ship.
- 0
- advisories outstanding against any of them.
- 146,238
- words of architecture documentation across 40 files.
- 7,271
- lines behind the page you are reading. 2,871 of them draw the object on the right.
- 0
- cookies set by this page, in any browser we could find one in.
- 12
- directives in this page’s Content-Security-Policy. Our own host’s analytics beacon is refused by it.
Counted 28 August 2026 against the Vault For Us repository withwc, grep and npm audit. Nothing here is read out of the commit history. The repository is private until the beta opens. When it opens, count it yourself.
07 / Questions
Asked plainly, answered plainly
What if I lose my phone?
A recovery code restores your identity, your circles, and your safety numbers on a new device. Your family confirms it is you — the servers never could.
Can Aevoris see anything at all?
We can see that ciphertext arrived and how much storage it occupies. Names, contents, locations — even the rhythm of your activity — are sealed before they reach us.
What does “end-to-end” actually mean?
Your data is encrypted on your device, with keys that never leave your family’s devices. Servers store and forward sealed envelopes they cannot open.
Is it open to audit?
Not yet, and we would rather say so than imply otherwise. The architecture documents, the test suites, and the ledger of what has not been verified all open when the beta does. Until then we send them to anyone who asks. We would rather publish our open questions than only our claims.
What does it cost?
Early access is free while we finish hardening. Plans will be priced for families — one price that covers everyone in the household.
Can I leave and take everything?
Yes. Export your documents, credentials, and history at any time, readable without us. Leaving is a supported feature, not a loophole.
08 / Early access
Bring your family inside.
We are inviting founding families as hardening completes. Leave an address and we will write to you. Nothing else is ever done with it.