Security Architecture & Audits
At Shinrai Apps and our parent engineering division Shinrai Ops, trust is verified mathematically through cryptographic proofs, hardware-bound isolation, and public disclosure.
Hardware Keystore
Secrets never exist unencrypted in device RAM or disk. Master keys are anchored within Android StrongBox Keymaster or Apple Secure Enclave coprocessors.
Zero-Knowledge Primitives
Passphrases and encryption seeds are derived locally with Argon2id memory-hard algorithms. Our engineers never possess the keys to decrypt your files.
Mutual TLS (mTLS)
All cloud integrations with shinraiops.com utilize client certificate authentication, preventing man-in-the-middle attacks and impersonation.
Cryptographic Standards Deployed
| Domain | Algorithm & Primitive | Key Length / Specification | Implementation |
|---|---|---|---|
| Local Vault Encryption | AES-GCM / ChaCha20-Poly1305 | 256-bit symmetric | Hardware Keystore |
| Key Derivation (KDF) | Argon2id / PBKDF2-HMAC-SHA256 | 64MB memory cost, 4 iterations | Native Rust Core |
| Network Transport | TLS 1.3 with HSTS Pinning | X25519 & ECDSA P-256 | Strict Certificate Pinning |
| Two-Factor Authentication | RFC 6238 TOTP & RFC 4226 HOTP | SHA-1 / SHA-256 / SHA-512 | Local Sandbox Only |
We welcome vulnerability reports from independent security researchers. If you identify a potential security vulnerability in any of our mobile applications, APIs, or infrastructure, please report it immediately:
We commit to acknowledging your submission within 24 hours and providing status updates throughout the remediation process.