Automation
Automation you can actually control
Build workflows in a visual rule graph instead of stacking fragile checkbox rules. Revise a job with AI assistance, then dry-run it and see exactly what would move before anything does.
← All work
- macOS 12.0 or later
- Apple Silicon compatible
- Windows
VaultSort
The first app with true hardware-bound file encryption.
No other app binds file encryption to your hardware this directly: one tap, and the file is locked to a key only your fingerprint or physical security key can produce. The rest is a file manager built the same way round. Every rule is visible, every action previews before it runs, and the encryption design is published rather than asserted.
- Price
- $24.99 one-time
- License
- Up to 3 machines
- Data
- Runs entirely on-device
- Reviewed
- MacSources, 92% Excellent
Encryption
One-tap encryption, bound to your hardware
One tap encrypts with Touch ID or a YubiKey, using keys only your hardware can produce. No password to remember, no password to leak. AES-256-GCM with multi-key support, so more than one device can unlock the same file.
Transparency
Encryption you can read, not just trust
The algorithms, key-derivation chain, file layout, and threat model are all documented and published as a free whitepaper. Security you can audit beats security you are asked to believe in.
Storage
Reclaim storage with the right tools first
Space Saver surfaces reclaimable caches, temporary data, logs, and browser clutter without sending you digging through hidden folders. Large File Finder adds per-app category control.
Deletion
Secure deletion built for modern drives
Detects SSDs versus spinning disks and applies the correct secure-deletion strategy for each, instead of reusing legacy overwrite logic everywhere.
Under the hood
How a file gets locked to your hardware
Password-derived keys can be guessed, phished, or reused. The point of binding to hardware is that the secret never exists anywhere an attacker can reach it, even holding the encrypted file and the credential database. Four steps, and the design is published rather than asserted.
- 01
A fresh file key
Each file gets its own random 256-bit key. Never reused across files, never written anywhere in the clear.
- 02
The hardware answers a challenge
The authenticator computes an HMAC over a per-credential salt using a secret that never leaves the YubiKey chip or the Secure Enclave. It returns 32 bytes only that device can produce.
- 03
A wrap key, unique per file
HKDF-SHA-256 mixes the hardware output with a random per-file salt and the credential ID, so the wrap key differs for every file even on the same key.
- 04
Seal, then encrypt
AES-256-KWP wraps the file key; AES-256-GCM encrypts the body with the entire header authenticated. A file can hold several wrapped key slots, so a YubiKey and Touch ID can each open it independently.
Contact
Have something exacting to build?
I take on selective full-stack and native work: secure systems, desktop apps, and data-heavy interfaces. Based in Oklahoma City, working remotely.