Mortui implements a defense-in-depth security architecture with multiple layers of protection to ensure user data privacy, system integrity, and secure action execution.
Multi-Factor Authentication
Fingerprint + PIN with PBKDF2 hashing (face unlock opt-in)
Authorization & Permissions
Feature access gated by your plan (free or full version)
Session Management
Volatile auth state — always locked after a process restart
Encryption (AES-256-GCM)
AES-256-GCM encryption for all sensitive data at rest
Key Management (Keystore)
Hardware-backed key storage in the Android Keystore
Secure Storage (SQLCipher)
Encrypted SQLite database with Keystore-derived passphrase
TLS/HTTPS Transport
Encrypted network communication for all external services
Validated TLS Stack
Provider traffic uses Android’s validated TLS stack and system trust store
API Security (OAuth 2.0)
Secure authentication for Gmail and Outlook integration
Emergency SMS From Your SIM
Texts to any emergency contacts you add go through Android’s own SMS manager from your number — no gateway, no third party, and a send-only permission with no ability to read or receive messages
Android Permissions
Principle of least privilege for system access: send-only SMS requested only if you add an emergency contact, no contacts, no call log, no message reading
Hardware Security
Utilizes device security hardware where available
Release Hardening
R8 code shrinking and obfuscation, resource shrinking, and redacted logs
Mortui implements a comprehensive authentication system with multiple layers to protect configuration access while allowing background operations to execute autonomously.
Strong fingerprint authentication (Class 3 / BIOMETRIC_STRONG) via BiometricPrompt. Face unlock is opt-in under Security settings — most Android face implementations are Class 2 and insufficient for security-critical actions.
PBKDF2-HMAC-SHA256, 100,000 iterations, with a per-user random salt
128-bit random recovery code, shown once and stored only as a hash
All sensitive data is encrypted using AES-256-GCM, the same encryption standard used by governments and financial institutions worldwide.
The entire database is encrypted at rest using SQLCipher 4.6.1, providing transparent AES-256 encryption of all data, indexes, and journals.
Hardware-backed key management using the Android Keystore. Keys are generated inside the device’s secure hardware and are never exposed to the app.
Your secure on-device vault for sensitive files, email attachments, and structured data. Import files freely and export them whenever needed. One thing to know before you rely on it: when the switch fires for real, the vault is erased as the final step — after any vault files you attached have been delivered to your recipients.
Files are overwritten three times — random data, zeros, then ones — each pass flushed to disk, and then deleted. Combined with Android’s file-based encryption, the remaining content is not practically recoverable.
On by default across the whole app. Can be turned off in Security settings if you need to capture the screen.
No PIN, passphrase, secret, or emergency code values are ever written to logcat.
Release builds use minification and resource shrinking with R8 for obfuscated DEX output.
Mortui includes a comprehensive security scoring system that evaluates your configuration and provides recommendations for improvement.
We will answer specifics — including what Mortui deliberately does not do.