You shouldn't have to trust us.
So we built it that way.
Quackr ID's vault is zero-knowledge: your passwords are encrypted on your device with a master password we never see, on an open-source engine anyone, including you, can audit.
The vault runs on Passbolt: audited code, not marketing claims
We didn't write our own cryptography, and you should be suspicious of anyone who did. The Quackr ID vault is built on Passbolt, an established open-source password manager engine: OpenPGP end-to-end encryption, public code, independent security audits on record, and years of production use by security-conscious organizations, with no known breach of its cryptography.
That's the difference between "trust us, it's encrypted" and "here is the exact code that encrypts your data. Check it, or rely on the security community that already has."
Payments never touch us
Subscriptions run end-to-end on Stripe; virtual cards come from a regulated card provider. Your full card number is never stored on Quackr servers, or even transmitted through them.
Real numbers, real carriers
Your private number is a real mobile number on carrier networks, not a recycled VoIP pool. It's yours while you subscribe, and released (never resold with your history) if you leave.
Responsible disclosure
Found something? Email security@quackr.io; it reaches the engineering founders directly. We respond fast, credit researchers, and never lawyer up on good-faith reports.
Security questions, straight answers
No, structurally, not just as policy. Vault entries are encrypted on your device with keys derived from a master password we never receive. Our servers store ciphertext we have no means to decrypt.
The vault runs on Passbolt, an established open-source password manager engine with OpenPGP end-to-end encryption, independently audited and used by security-conscious organizations worldwide. Its code is public, so anyone can inspect the cryptography we rely on.
No. And the architecture means even a breach of our infrastructure would not expose usable vault data. An attacker could only copy encrypted ciphertext; the keys stay on your devices.
Your recovery kit, generated at vault setup, is the only way back in. We cannot reset a master password; that inability is the security guarantee. Store the kit somewhere safe.
Email security@quackr.io. Reports go straight to the engineering founders; we respond quickly, credit good-faith researchers, and never pursue legal action for responsible disclosure.