helixvault.co.uk

Helix Vault

A zero-knowledge vault for firms that cannot afford a leak. GeekyBee installs it. You hold the keys. The server never sees the letter. The house holds every vault; your email only shows the doors that list you.

The house

Your email is checked against authorised users only. You see only the vaults where that address is on the list.

The vault

Each vault is its own strongroom. It has a Vault Master with overriding control of that vault.

The shelves

Inside the vault are shelves. A shelf is a department: an authority holder (head) and shelf users — usually the same department, or another if they hold more than one shelf.

Poke and peek

The action is on a shelf. Poke (write or upload) needs a witness on the same shelf. Peek (read) needs a head on a different shelf.

I have a vault here

Use the email on your Helix record. Next you see your doors. Unlock that vault (Vault Master or shelf holder) with password and authenticator. Then you peek or poke — or, if the vault is still being opened, you wait for the ceremony.

A browser may fill in the computer owner’s mail — ignore that.

I have not got one — I want one

You cannot mint a vault on this page. Send your details. GeekyBee opens a new empty host and runs the installation ceremony with you as Vault Master. This public site may already hold another client’s vault — that is why the ceremony is not this form.

How the vault protects you

  • Plaintext lives in the browser only. The server stores a second envelope it cannot read.
  • Two identical values never look the same on disk.
  • We do not keep authenticator recovery codes. A stolen database must not be a spare phone. Lost authenticator is a ceremony with GeekyBee and the Vault Master, not a file we hold.
  • Mobile numbers are contact details for the ceremony and for the panel — not a second password stored as a login secret.