Skip to content
PulsVaultDocs
Get started
TeamBusinessEnterprise

Encryption policies

Choose which encryption algorithms your organization's vaults may use, set the organization-wide default, and understand the plan-gated tiers.

Every vault encrypts its items on the member's device with its own key (DEK). Encryption policies let you decide which algorithms members may pick when creating vaults and which one is used by default. A single backend policy service is the only place these rules are enforced — every vault and item creation is validated against your policy and your plan.

Available encryption types#

Algorithms are tiered by plan; higher plans unlock everything below them:

Type Tier Best for Minimum plan
AES-256-GCM Standard Default — fast, hardware-accelerated, authenticated All plans
ChaCha20-Poly1305 Advanced Constant-time; fast on devices without AES hardware Team
AES-256-CBC + HMAC Compliance Encrypt-then-MAC for FIPS-style compliance requirements Business
XChaCha20-Poly1305 Enterprise Extended nonce — highest theoretical security margin Enterprise
None (plaintext) Danger Non-sensitive storage only Enterprise + explicit opt-in

The console lists only the algorithms your plan carries. Tiers above your plan are not shown at all — not even locked — and the server independently rejects any request for an algorithm your plan doesn't include. None never appears in the list of allowed types; see Unencrypted storage.

How the policy is applied#

When a member creates a vault, the effective encryption type resolves in order:

  1. The type the member explicitly picked (validated against your allowed list and plan)
  2. For items: the parent vault's type
  3. Your organization's default vault encryption type
  4. Fallback: AES-256-GCM

Two invariants always hold: each member's primary vault always uses AES-256-GCM, and sharing a vault preserves its algorithm because recipients receive the same DEK.

Your allowed list narrows within your plan; it never widens beyond it. Listing a type your plan does not include has no effect, and the policy page refuses a list that would leave your members with nothing to choose.

Configuring the policy#

  1. Go to Organization → Security policies → Encryption (the page is titled Encryption Policies).
  2. Pick the Default Encryption Type — selecting a type automatically adds it to the allowed list.
  3. Under Allowed Encryption Types, switch on the algorithms members may choose. You must keep at least one type enabled, and you cannot disable the current default.
  4. Select Save Policies. New vaults follow the policy immediately; existing vaults keep their algorithm.

The Effective Posture card at the top shows your Current Plan, the Default Algorithm, and how many allowed types are Active.

Unencrypted storage (Enterprise)#

The None type stores data as plaintext and exists for genuinely non-sensitive records. Enabling it requires a two-step opt-in: it is Enterprise-only and an organization admin must explicitly enable it. On any plan below Enterprise the Allow Plaintext Storage section is not on the page at all. On Enterprise, select Enable Danger Zone, read the Acknowledge Risk dialog, and confirm with I Understand, Enable; Disable Plaintext turns it off again. Without that flag the server refuses NONE for every member, organization-wide.

Plaintext means no protection

Items in a NONE vault are readable by anyone with database access and are excluded from zero-knowledge guarantees. Each use is logged. Leave this off unless you have a specific, reviewed need.

Was this page helpful?