HIPAA
We are not HIPAA certified and do not offer a BAA. Eirvr is invitation-only Alpha, not a covered-entity or business-associate offering.
Program status
Compliance status
Your vault encrypts on your device first. Formal compliance programs will follow when they are real and ready.
GDPR
We design for data minimization (ciphertext in the vault), but we are not advertising a completed GDPR certification or a standard DPA package.
SOC 2
No SOC 2 engagement is in progress and we are not publishing a completion date. That work belongs on a later wave, not this Alpha.
What we actually hold
Encryption is not immunity
Encrypting your files does not put them outside the law — it changes what we are able to produce if the law reaches us. We will comply with valid legal process for whatever we actually hold: account email, operational metadata, and ciphertext. Because we never receive your passphrase or an unwrapped key, that compliance cannot include decrypted vault contents — there is no request we can be served that gives us a technical way to read them. Separately, and regardless of anything we can or cannot produce, you remain responsible for your own obligations: whether local law restricts your use of encryption, what you must disclose to authorities where you live or do business, and how you respond to any request made of you directly about your data. That relationship is between you and your jurisdiction, not something encrypting a file changes or something we can stand in for. If you are unsure how encryption or data-disclosure law applies to you, we recommend counsel familiar with your jurisdiction.
- Vault contents
- Client-side AES-GCM means we cannot read file plaintext. That is what zero-knowledge means for this vault.
- Account metadata
- Email, timestamps, and ciphertext blobs still exist on our side. We do not claim we have nothing to produce if lawfully required. What kind of operational metadata can we see? Here’s an example.
- Payments
- During the Alpha and Beta testing phase, no payments are accepted — your testing license covers any cost that would otherwise apply. When we move to live, paid products, we will publish our proposed pricing scale and our payment-provider integration here in advance of that change.