Security & provider disclosures

DevLockAPI is an independent provider directory with an optional personal vault. A listing is not an endorsement or evidence of affiliation. Providers can change API eligibility, prices, availability and terms. SDK, self-hosted and restricted tools are labeled separately from hosted APIs. DevLockAPI never sends your stored keys to a provider and never makes API requests for you. How your vault is protected: vault contents and private lists are encrypted on your device with AES-256-GCM before they are uploaded, and travel only over HTTPS. The key that opens them is wrapped with your recovery passphrase using Argon2id (64 MiB of memory, 3 passes) for new vaults; older vaults use PBKDF2 with 600,000 rounds until the passphrase is next changed. API key values get a second, separate key that exists only in the DevLockAPI phone app, inside Android Keystore, and in your 24 recovery words; the website never receives or shows them. Keys you mark as risky need a fresh fingerprint or face scan for every reveal or copy, and copied keys are cleared from the phone's clipboard after 30 seconds. How sign-in is protected: private access needs your password plus a 6-digit authenticator code or a passkey (in supporting browsers, and in the app on Android 14 and newer). Code guesses are capped per account and per network. Authenticator codes authorize access; they are not encryption keys. A browser you choose to trust can keep encrypted unlock material so a code reopens the vault there; your recovery passphrase is still needed to recover the vault or trust another device. How the website and app are protected: the website can't be embedded in other sites, runs only its own scripts, and tells browsers to use HTTPS for two years. The phone app blocks screenshots of its screens, keeps sign-in sessions in memory only, talks only to DevLockAPI's server over HTTPS, and locks the vault when you leave it or after five idle minutes. Limits: forgetting a device or changing your passphrase can't recall copies already made elsewhere. A compromised, unlocked device or malicious code delivered to your browser can expose what you open. Revoking a session blocks future access but can't erase existing copies. Account, sign-in, billing and operational metadata are not end-to-end encrypted. No absolute security or uninterrupted service is promised. Only synthetic demo_ credentials are allowed in this build. An independent security review, checks of the deployed service and testing on physical phones are still required before real keys are allowed. These disclosures don't override rights or responsibilities that can't legally be excluded.