/
Menu

What we can and can't see

What StackHangar's servers can see, and what they never receive. Secrets are encrypted and decrypted only on your device.

StackHangar is zero-knowledge: secrets are encrypted and decrypted only on your device. Our servers store ciphertext and the few dates alerts need.

#What we never receive

  • Your values, item names, notes and project names. They are encrypted before they leave your device, so we can't tell a Stripe key from a domain renewal.
  • Your vault key, in any unwrapped form.
  • Your recovery key. It is checked on your device.
  • The secret your passkey makes to open the vault.
  • Anything decrypted during an export.
  • Credential values for AI agents. Agents get reference IDs and your approve or deny answer.

#What we can see

  • That you have an account, your email address, and when you sign in.
  • Your encrypted records.
  • For alerts, an opaque ID and a date for each item. Alert emails say how many items need attention and when, with no project, provider or key name.
  • Security events such as passkey changes, shown in your Activity log.
  • Which passkeys you have, by the name you or your device gave them.

#How unlocking works

To keep you unlocked across reloads, your browser keeps the vault key wrapped under a random device key, and our server holds only that device key. Neither half opens the vault alone. See unlocking.

When you ask for an AI explanation of a finding, only fixed-list fields leave your device: the finding type, the provider and roughly how soon it is due. Never names, values, notes, URLs or dates.

#Known limits

  • Malicious code served from our app could read the vault key when you unlock. We reduce this with a strict content security policy, no third-party scripts and an app origin separate from our website.
  • A copied browser profile, copied while you are unlocked, could open the vault. If a device is lost, remove its passkey, rotate your vault key and rotate the credentials stored in it.
  • A compromised device: malware on the computer you unlock from can see what you see.

Your passkeys work only on app.stackhangar.com, so no other page can ask for them. To report a security issue, email hello@stackhangar.com with "Security report" in the subject.