Security so excessive, it's almost paranoid.
Most encryption is a door lock, easily opened with a credit card. SparkVault is two deadbolts, a swing bar, a security chain and reinforced hinges. Way more than you need. But you'll sleep easy.
Secret sharing, file storage and sign-in for your team and your product, behind three independent keys.
-
Secret sharing Free
Send a password or an API key as an x.sv link that burns the moment it is read. Free on every plan, forever.
Send a secret -
Secure file storage
Folders, uploads and sharing links like any cloud drive, with every file sealed by the Forge under three keys.
Store your files -
Secure identity
Passwordless sign-in for your app: passkeys, one-time codes and social login, from an OpenID Connect identity provider.
Add sign-in to your app
Most encryption hangs on one key.
Most companies encrypt with a single AES key. If that key leaks from a developer's laptop, a misconfigured server or a compromised backup, everything it protects is exposed at once.
LastPass, 2022
One developer's machine, one master key, and millions of customers' vaults copied.
Single-key encryption has a single point of failure. SparkVault is built without one.
Three keys, held by three different parties
Opening a Vault takes all three. SparkVault holds the first. The second is your account's own key, held inside a FIPS 140-3 validated key management service run by a separate company. You hold the third. A breach of any single party, including us, reveals nothing.
Read the security architecture
- SparkVault Master Key (SVMK)
- Held by SparkVault: a system-wide post-quantum ML-KEM-1024 keypair, kept in a hardened managed secret store.
- Account Master Key (AMK)
- Your account's own HMAC key, held inside a FIPS 140-3 validated key management service that even SparkVault's engineers cannot extract it from.
- Vault Master Key (VMK)
- Held by you: a per-Vault key SparkVault generates when the Vault is created and shows you once. A self-managed VMK is never stored by SparkVault, only a one-way verifier of it, so if you lose it, we cannot help you. Choose the Hosted VMK instead and SparkVault keeps it wrapped by the key management service, which features like public sharing need.
- The Forge
- Where the keys meet. Clear bytes stream in, are encrypted with AES-256-GCM, and emerge as hardened Ingots stored in your Vault. On the way out the keys meet again and plaintext streams to the client that asked. Your data is never at rest unprotected.
Sparks, the one-time secrets, use two of the three: the SVMK and your AMK.
Is this overkill? Probably.
Will SparkVault keep your data safe? Absolutely.
Seal a secret with one request
SparkVault hardens the weak points attackers actually target: secrets in transit, credentials pasted into chat, keys sitting in config files.
Plain JSON over HTTPS, with SDKs for JavaScript and for React Native and Expo. No cryptography expertise required.
Read the API referencecurl https://api.sparkvault.com/v1/sparks \
-H "X-API-Key: $SPARKVAULT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"payload": "the launch code is 793-alpha", "ttl_minutes": 60}'
{
"data": {
"spark_id": "spk_abc123def456...",
"size_bytes": 28,
"status": "active",
"expires_at": 1702003600,
"ttl_minutes": 60
}
}Everything SparkVault does is a compound of five Elements
The Slack app, the CRM integrations and anything you build on the API are all made of the same five.
- Sparks One-time secrets that burn on read 256,000 bytes, 24 h max
- Vaults Storage that opens only with all three keys 3 keys, every time
- Ingots The encrypted files a Vault holds 1 byte to 5 TB
- SparkLinks Trackable single-use share links x.sv
- Entropy Randomness from validated hardware security modules NIST SP800-90A
No premium tier for the cryptography
Every SparkVault account gets the same keys, modules and algorithms, and hardware-backed keys from the first day.
Read the compliance overview- FIPS 140-3
- Level 3 validated cryptographic modules. Tamper-evident, tamper-resistant hardware.
- SOC 2 Type II
- Continuous monitoring. Annual third-party audits. Full audit trail.
- Your Vault key
- SparkVault keeps only a one-way verifier of a self-managed VMK, so a copy of its database and storage reveals none of your Vault's data. The white paper states the exceptions.
- Post-quantum
- ML-KEM-1024 (Kyber), the NIST-approved standard (FIPS 203), resistant to quantum computers today.
- Hardware-backed keys
- Account keys live in dedicated hardware modules, non-extractable by design.
- REST API
- A published OpenAPI spec and SDKs for JavaScript and for React Native and Expo.
Send your first Spark
Sparks are free on every SparkVault account, with no credit card. Paste a secret and share the link: it burns the moment it's read.