Security
How Silo protects your photos
Silo encrypts everything on your phone, keeps the keys there, and has no account and no server. This page says what that means, what it protects against, and where it stops.
Encrypted on your phone
Every photo, video and file is encrypted before it is written to storage, using XChaCha20-Poly1305 with 256-bit keys. That cipher hides the contents and also notices if a single byte has changed. Your PIN or passphrase is turned into a key with Argon2id, a method built to be slow and memory-hungry so that guessing is expensive. The keys exist on your phone, and in your recovery phrase, and nowhere else.
Read more in on-device encryption.
What is never stored unencrypted
Photos, videos and files are stored only in encrypted form. Names, dates and albums are encrypted with them, not kept beside them. When you view a photo or video, Silo shows it from memory, and no readable copy is written to the phone’s storage. The two exceptions are copies you make yourself: an item you share leaves a readable copy on the phone for as long as the share sheet is open, and an export is a normal file.
Locking clears the keys
When Silo locks, which happens when the screen turns off or after the auto-lock time you choose, it clears the keys and caches from memory. To see anything again you unlock. A plain cover also replaces your photos in the app switcher. See auto-lock and the privacy screen.
No account and no server
Silo has no sign-up, no email and no server holding your vault. That is why nobody can reset your PIN, and why nobody at Silo can open your photos. It is also why your recovery phrasematters: it is the only way back in if you forget your PIN.
What Silo collects
Silo collects diagnostics only if you agree. You are asked once in setup, and you can switch it off in Settings. The diagnostics are device model, system and app version, performance numbers and error reports without anything that could hold a file name. Purchases are tied to a random ID, not to your name or an email. There are no ads and no ad tools in the app. Silo never collects your keys, PIN, passphrase, recovery phrase, file contents, or the names of your files and albums. The details are in the privacy policy.
Backup, arriving with launch
Backup is being finished and arrives with launch. It is designed so that everything is encrypted on your phone before it is uploaded to your own cloud storage, so Silo and your cloud provider only ever hold scrambled files. See encrypted backup.
A published format, and a tool that opens it
The way a Silo vault is built is written down in the published format. A separate, freedecrypt tool, written from that document alone, opens a copy of a vault with your recovery phrase and no app. That lets experts check our claims, and means your files never depend on us.
What Silo protects against, and what it doesn’t
Protects against
| Situation | Why |
|---|---|
| Someone picks up your unlocked phone and opens your photo library | Photos you moved into Silo and removed from the library are not there to find. They are only inside the vault, which needs your PIN, passphrase or face or fingerprint unlock. |
| A lost or stolen phone | The files in the vault are encrypted, and the keys are not stored in a readable form. Wrong guesses at the lock screen are slowed down. |
| Someone who copies the phone’s storage | They get scrambled containers. Without your PIN or recovery phrase they cannot be read. |
| A breach of Silo itself | Silo has no server and no account, so there is no database of users or photos to break into. |
| A cloud account breach, once backup ships | A backup is encrypted on your phone before it is uploaded. Someone who gets into your cloud account finds only scrambled files. |
Doesn’t protect against
| Situation | Why |
|---|---|
| Spyware already on the phone | Software that can see your screen or your keystrokes sees what you see, including an open vault. |
| Someone forcing you to unlock | If you are made to enter a PIN, show your face or press your finger, the vault opens. |
| A weak recovery phrase | A 2-word phrase can be cracked by a powerful computer. Choose 12 words, or at least 6, for anything private. |
| Shoulder-surfing your PIN | Someone who watches you type, and then gets your phone, has your PIN. Cover the screen in public. |
| An unlocked, open vault | While Silo is open, what is on screen can be seen, photographed or recorded by another device. |
| Copies you make yourself | Photos you export or share leave the vault as ordinary files. Protect or delete them. |
Honest limits
- If you lose both your PIN and your recovery phrase, your vault stays closed for good. Nobody can reset it.
- Without a backup, a lost or broken phone means a lost vault. Uninstalling Silo removes the vault from the phone too, and the phone’s own backup doesn’t copy it, so export first or keep a Silo backup.
- Silo can’t block screenshots on iPhone. It can on Android.
- Silo is not in the app stores yet, and features marked as arriving with launch are not available today.
- No app is perfect. If you find a problem, write to support@silo-private-vault.fyi so we can fix it.