Nobody at PineKey
The key that unlocks your vault is derived from your master password, and the master password itself never reaches our servers. So nobody at PineKey can open your vault: not support, not the person running the servers, not the hosting provider. Asked to hand over your passwords, we could hand over encrypted data and nothing else.
What the service does see
Our servers see some things, because they have to in order to run the service: your email address, which organisations you belong to, who has which permissions, and when things changed. The trust page lists this plainly, and the privacy notice says what is processed.
Two limits
Your own device is the one place the vault is open, so a compromised computer or phone can see what you see. And the web vault’s code is served by our server, so you are trusting us to serve honest code; the browser extension keeps its own copy.
In short
- Encryption starts on your device; the master password is not sent to the application API
- PineKey cannot recover vault contents by resetting a forgotten master password
- Email, membership, permissions and timestamps are visible to the service