Security
Seven layers of protection
Citadel Vault does not rely on a single safeguard. Your secrets are protected by seven layers, from air-gapped hardware at the bottom to the recovery protocol your heirs follow at the top.
Seven layers of protection
7
Recovery protocol
Open archive format, Bitcoin timelock, archival disc
6
Threshold recovery
Any K of N PIN-locked Vault Cards
5
Vault Master Passphrase Entropy
Five sources hashed into your 24 words
4
Cryptography
Argon2id, HKDF-SHA256, AES-256-GCM
3
Guardian application
Rust, no network code, independently audited
2
Vault OS
Minimal system with no network stack
1
Air-gapped hardware
No network radios, no camera, signed model manifest
Check your current setup
The Vulnerability Risk Score estimates how exposed a Coldcard setup is to the July 2026 seed-generation flaw. It runs entirely in your browser.