Data Protection & Compliance
OxidVault is built for organizations with strict data-protection and confidentiality requirements. This page explains the data-protection implications of deploying OxidVault in your environment. For how this website handles visitor data, see our Privacy Policy.
Your data never leaves your infrastructure
- Offline-first: .oxid vault files stay on your device, network share, or your own server. No cloud — no OxidVault-operated server holds your secrets.
- Zero-knowledge: master password and contents are encrypted and decrypted locally only (Argon2id, AES-256-GCM). The vendor has no technical access to your secrets.
- Data residency: because storage is under your control, your data stays in your chosen jurisdiction. No cross-border transfer is introduced by us.
GDPR-ready by design
GDPR applies to any organization processing EU residents' personal data, regardless of where the software vendor is based. OxidVault supports compliance by removing the vendor from the data path entirely.
Because OxidVault never receives, stores, or processes your vault data, it does not act as a processor for that data. In many setups this means no data processing agreement (DPA / Art. 28 GDPR “AVV”) with OxidVault is required — unlike cloud password managers.
| Cloud password manager | OxidVault | |
|---|---|---|
| Storage location | Vendor-operated servers | Local / your own infrastructure |
| DPA with vendor | Typically required | Typically not required |
| Cross-border transfer | Assessment needed | None introduced by us |
| Vendor access to data | Possible (vendor holds keys/infra) | None (zero-knowledge) |
You remain the sole controller
- Full data sovereignty: you decide storage location, access, and deletion.
- Your own obligations remain: technical and organizational measures, records of processing activities, and access control. OxidVault provides technical building blocks (next section).
Technical building blocks for your compliance
- AES-256-GCM encryption, Argon2id key derivation
- Tamper-evident audit log (SHA-256 hash chain) + PDF compliance report
- Access control: master password, optional TOTP 2FA, auto-lock, centralized admin policy (GPO)
- Open source (AGPLv3): independently auditable; parsers continuously fuzz-tested
Source code and architecture documentation for reviewers: GitHub repository and ARCHITECTURE.md. Further security and feature details are on the homepage Features section.
Frequently asked questions
Do I need a data processing agreement (DPA) with OxidVault?
Typically no. OxidVault does not receive, store, or process your vault data, so in many deployments we are not acting as a processor under GDPR Art. 28. Unlike cloud password managers, a DPA with OxidVault is often unnecessary — but you should assess your specific deployment and obligations.
Are my passwords stored in the cloud?
No. Vault files (.oxid) remain on your device, network share, or server you control. OxidVault does not operate cloud infrastructure that holds your secrets.
Can OxidVault see my data?
No. OxidVault is zero-knowledge: your master password and vault contents are encrypted and decrypted locally only (Argon2id, AES-256-GCM). The vendor has no technical access to your secrets.
Where is my data stored / which jurisdiction?
Wherever you choose to store it — local disk, your file server, or infrastructure in a jurisdiction you select. You control data residency; OxidVault does not introduce cross-border transfer of vault data.
What about optional Git synchronization?
If you use Git sync via a third-party provider (e.g. GitHub, GitLab, or your own server), the data-protection relationship is with that provider. The .oxid file remains end-to-end encrypted with AES-256-GCM throughout.
Is OxidVault suitable for regulated industries (healthcare, legal, finance)?
Yes — precisely because processing stays local and vault data is not transmitted to OxidVault. Your own technical and organizational measures (TOMs), records of processing, and access policies remain authoritative and are your responsibility to maintain.
This information is not legal advice. Data-protection assessment depends on your specific deployment. Please evaluate your obligations independently, and consult your data protection officer or legal counsel where appropriate. Contact: support@oxidvault.com