Frequently Asked Questions

VegaCrypt is a secure way to exchange confidential files, messages, voice, and video. It is not cloud storage and not a place where files sit forever. Your data is protected with strong encryption before it leaves your device. Every transfer has a lifetime: you choose how long it stays available, or it is removed automatically when that time is up — or as soon as the recipient has opened it.

Start on the Free plan. An account takes a minute, and you can send protected transfers at no charge. Paid plans are there when you need larger files, longer retention, or more capacity. The person you send to does not need an account. They open a secure link in the browser.

Files, encrypted notes, and voice or video recorded in the browser. On Free and Basic, uploads stay within common documents, images, archives, and video. Executable and script files are not part of those plans. From Personal Plus upward — including Business plans — that file-type limit does not apply.

• Account holders: email is required (it is the login). The password is stored as a hash. Optional profile and billing data depend on the features you use (company seat, Stripe, social login, SSO, EMP). • Recipients and Safebox guests: no VegaCrypt account is created. The service stores transfer ciphertext and may log technical data (such as IP) for abuse protection. • Corporate users: tenant identity, members, licenses, and — if enabled — Microsoft Entra SSO attributes needed to sign in. We do not use advertising trackers or third-party marketing analytics in the product app.

Yes, for security and abuse protection (rate limits, brute-force lockouts, attack detection). These are operational security logs, not a marketing profile.

You cannot send a transfer without an account. You can receive a Password Access or Dual-Key link without registering, and you can upload as a guest to a Safebox invite or Embed. Completely account-free use applies only to those receive / guest-upload paths.

No advertising trackers and no marketing analytics in the product app. Signed-in sessions use technical cookies (and similar storage) so you stay logged in. Sign-in with Google, LinkedIn, Microsoft, or Entra, and Stripe checkout, are third-party services with their own cookies when you use those flows.

Three create methods — all use AES-256-GCM in the browser. The server stores ciphertext. The sender is always signed in. • Password Access (Client-Side): encrypted in the browser with a transfer password before upload. VegaCrypt cannot read the content. The recipient opens the link with that password — no recipient account. • Dual-Key Link: encrypted in the browser. Access requires the full link (one key half in the # fragment) plus an email verification code (the other half). No shared transfer password. The sender sets a recipient email. The recipient does not need an account. • Vault (Send to VegaCrypt user): encrypted in the browser for a registered recipient. Content lands in Encrypted Inbox; the recipient’s Encryption Master Password (EMP) unlocks it. Safebox inbound uses Vault on the owner’s key.

Dual-Key Link splits the decryption key in two. One half stays only in the share-link fragment (#…); the other is released after the recipient verifies their email with a one-time code. The browser combines both halves and decrypts locally. Either half alone is not enough. The recipient does not need a VegaCrypt account or EMP. The sender must be signed in. Outlook Secure Attach uses Dual-Key only (not password, not Vault).

• Password Access: maximum privacy when you can share a password on a separate channel. Recipient needs no account. • Dual-Key Link: you know the recipient’s email and want inbox-bound access without inventing a shared password. Recipient needs no account. • Vault (EMP): sending to a registered VegaCrypt user, or receiving via Safebox / Embed into Encrypted Inbox.

On Password Access, Dual-Key Link, and Vault create-paths — no. The service stores ciphertext. Decryption happens in the browser. For Dual-Key Link, confidentiality requires both the link fragment and the server-held half released after email verification. For Vault / Safebox, EMP stays on the client.

Safebox is an inbound channel: you create a channel, invite a guest, and they upload content to you. Uploads are Vault-encrypted in the browser and arrive in Encrypted Inbox. Guests do not need a VegaCrypt account. You (the owner) do. There are two channel kinds: • Invite (Links): personal invite link, typically sent to a guest email. • Embed: file widget on your site (file type only). Embed is a higher-plan option (Personal Pro and Business licenses that include embed), not available on Free / Basic / Personal Plus.

1. Create a Safebox channel. Content type is fixed per channel: files, text, audio, or video (Embed is files only). 2. Share a personal invite (or place an Embed widget, if your plan includes it). 3. The guest opens the invite / widget and uploads in the browser — no VegaCrypt account. 4. You unlock the delivery in Encrypted Inbox with your EMP. Delete-after-first-access is not used on Safebox; lifetime follows product rules for that inbound delivery.

The owner needs a VegaCrypt account with EMP configured. Safebox invite channels are not on Free or Basic. They start at Personal Plus (and Business / Business Plus / Business Pro / Enterprise according to the license). Embed requires a plan that includes embed channels (Personal Pro and listed Business / Enterprise entitlements). Guests upload only via the invite or Embed — no account required.

No. One-time transfers are outbound: you upload and send a link. Safebox is inbound: clients send files, text, audio, or video to your channel, and deliveries land in Encrypted Inbox.

You choose a lifetime when you create the transfer, within your plan. Product ceiling is 30 days. Presets start at 1 hour. Free is shorter than paid plans (Free: 3 days; Basic: 7 days; Personal Plus / Business: 14 days; Personal Pro / Business Plus / Business Pro: 30 days). Exact numbers follow the live catalog.

When this option is on, the transfer is removed after the recipient successfully opens it. The link then cannot be reused. Signed-in senders can turn it on or off where the method allows. It is not used for Safebox inbound.

Yes. You can remove your outbound transfers from history / sent before expiry. Once a transfer is already deleted or expired, it cannot be brought back.

No. After deletion (automatic or manual) or expiry, the transfer is not recoverable through the product. There is no user-facing restore of content.

When the lifetime ends, the system expires and removes the transfer. It does not remain available past the configured lifetime.

Transfer-password recovery is not possible. VegaCrypt does not store Password Access transfer passwords. If that password is lost, the ciphertext cannot be decrypted. Dual-Key Link does not use a shared transfer password — access is link fragment + email verification code. Vault / Safebox uses the recipient’s (owner’s) EMP, not a per-transfer password. EMP recovery follows the account recovery-code flow, which is separate from transfer passwords.

Failed password and verification attempts are limited. After 5 failed attempts on a transfer, further tries are blocked for 10 minutes. Separate rate limits also apply to sign-in, forms, and guest Safebox resolve (by IP).

• Password Access: send the link and the password on separate channels (for example email + messenger). • Dual-Key Link: send the full link, including everything after #. The recipient also needs the one-time code sent to their inbox — no second password channel. • Vault / Safebox: the recipient (owner) unlocks with EMP; there is no per-transfer password to share.

Recording happens in the browser with the webcam and/or microphone — no desktop client. After recording you can review and send it encrypted, subject to duration and size limits on your plan. Free durations are short (on the order of 1 minute). Higher plans allow longer recordings.

Encrypted, like other transfers, for the lifetime you selected — or until first successful open if delete-after-first-access is on.

Yes, for audio and video transfers. Download is off by default; the recipient plays in the in-browser player unless you explicitly allow download before sending. This control does not apply to ordinary file transfers: those are downloaded (then decrypted) as files.

Yes. VegaCrypt is GDPR-compliant. The platform is built on Privacy by Design: we collect only what is needed to run the service, we do not use advertising trackers or marketing analytics, and you can delete your transfers and your account. Content on Password Access, Dual-Key Link, and Vault paths is encrypted in the browser (AES-256-GCM) before it reaches us — we store ciphertext, not readable files. Hosting in the United States does not take the product out of GDPR: personal data is processed under GDPR rules, with the same security and deletion controls. An EU region is on the roadmap to bring data closer to European customers.

Yes. VegaCrypt is built for confidential medical and legal handoffs and is HIPAA-compliant at the product level. Password Access, Dual-Key Link, and Vault encrypt in the browser; the service stores ciphertext only. Access is gated (password, Dual-Key email code, or EMP), with lockout after failed attempts, optional MFA, and a full transfer history. Covered entities and business associates can execute a Business Associate Agreement (BAA) with us.

VegaCrypt is designed and operated in line with ISO 27001 and SOC 2 control requirements: encryption in transit and at rest (ciphertext), access control, tenant isolation, audit of transfer lifecycle, and least-privilege operations. We are compliant with these control sets in the product. Formal ISO 27001 and SOC 2 attestation is the independent-audit step (paperwork in progress). The security architecture does not wait on that audit.

Our infrastructure runs in modern data centers in the United States. We plan additional regions (including the EU) so customers can keep data closer to their users and meet local placement preferences.

The sender is responsible for content. VegaCrypt is a technical delivery tool and cannot read content on Password Access, Dual-Key Link, or Vault paths. Users must comply with applicable law.

Illegal use is not tolerated. Access may be blocked for Terms of Service violations, and the operator may cooperate with law enforcement within applicable law. On E2EE paths the operator still does not hold plaintext.