Sigillum

Sigillum is the post-quantum encrypted vault built for the age of quantum computers - and there is nothing else like it on Google Play.

Every other "encrypted cloud vault" on the market still relies on cryptography (RSA, ECDSA, classical ECDH) that a sufficiently large quantum computer will break. Intelligence services already harvest encrypted traffic on the bet that they will decrypt it later. Sigillum is the first Android file vault built from the ground up on NIST-standardised post-quantum cryptography - the same algorithms governments are mandating for protecting classified data through the 2030s and beyond.

Your files. Your cloud. Your keys. Mathematically unbreakable, today and after Q-DAY.

POST-QUANTUM CRYPTOGRAPHY - STANDARDISED, AUDITED, FUTURE-PROOF
• ML-KEM-768 key encapsulation - NIST FIPS 203, the new global standard for quantum-resistant key exchange
• ML-DSA-65 digital signatures - NIST FIPS 204, integrity that survives quantum attack
• AES-256-GCM-SIV authenticated encryption - 256-bit symmetric strength, nonce-misuse resistant
• BLAKE3 key derivation - modern, fast, side-channel hardened
• Hybrid mode - every key exchange is layered with a classical primitive, so a break in one does not break the vault

WHY POST-QUANTUM MATTERS NOW
Anything you upload to the cloud today can be copied, stored, and waiting. The day quantum hardware breaks classical encryption, every file you ever protected with RSA or ECC becomes plaintext - retroactively. Sigillum is engineered so that does not happen to your data. Encrypt once, stay encrypted forever.

WHAT THE CLOUD CAN SEE: NOTHING
• File contents - encrypted with AES-256-GCM-SIV under quantum-safe keys
• File names - encrypted with random-nonce AES-CTR; the cloud sees opaque ciphertext
• Directory structure - flattened into an encrypted block store; folder shape, file count, and naming patterns do not leak
• Metadata - modification times are exposed only if you explicitly opt-in per vault
• Triple-redundant .cbor config inside every vault, self-repairing from a damaged copy

BRING YOUR OWN CLOUD - WE NEVER TOUCH YOUR DATA
Sigillum has no servers. EINIX never holds your files, your keys, or any account.
• Direct-to-cloud reads and writes - no fat local mirror that balloons to multi-GB
• Real-time camera-to-vault recording streams straight into your encrypted cloud tree
• Multi-GB files handled with 1 MiB streaming chunks - no OOMs, no temp plaintext

UNLOCKING IS A FORTRESS
• Biometric unlock, AndroidKeystore-bound, StrongBox-backed when the hardware supports it (tamper-resistant secure element)
• TOTP enrolment during vault creation - QR + base32 secret, ready for any authenticator
• Configurable auto-lock idle timer - the vault sleeps when you do
• Plaintext is decrypted only into a per-call cache directory and wiped on screen exit

MOUNTS LIKE A DRIVE - FEELS LIKE NORMAL ANDROID
Each unlocked vault appears as its own root in any Android file picker - Files, Photos, Obsidian, gallery apps. Browse, rename, move, multi-select, export-as-ZIP, open in any external viewer. The encryption is invisible until you lock the vault.

REDUNDANCY YOU CONTROL
One primary + as many off-site backup destinations as you want. Per-backup "Sync now" with timestamps. Every backup is self-contained.

PRIVACY BY ARCHITECTURE
• No accounts. No sign-in. No cloud of ours.
• No telemetry. No analytics. No advertising ID. No third-party SDKs.
• The only network traffic is whatever cloud app you chose to use

NO COMPETITOR OFFERS THIS COMBINATION
Cloud-native encrypted drives (Drive, iCloud, OneDrive) put the keys on the provider's servers. Zero-knowledge tools lock you into a single proprietary cloud. Sigillum is the only Android product that delivers all three at once: post-quantum cryptography, true zero-knowledge architecture, and bring-your-own-cloud freedom - backed by a full security suite.
Sigillum - sealed against today. Sealed against quantum computers.