How OTPilot protects your data — in plain language.
We store
We never see
Every item in your vault is encrypted on your device with AES-256-GCM, each with its own key, before it leaves it. Those keys are protected by your vault key (your recovery key) — generated locally, it never leaves your devices, and on each device it is itself locked by your master password. The server only ever holds ciphertext it cannot read. If our database were stolen, your data would be unreadable.
A collection's items are encrypted with a collection key that only its members hold: each member receives it wrapped to their own device key, and the server stores only those wrapped copies, the encrypted items and the encrypted name. Removing someone stops their access to future changes; anything they could already see may have been copied, so OTPilot suggests changing those passwords.
When you share just a 2FA code (not a collection) with a teammate, it's protected by a two-halves system: one half lives in your teammate's extension, the other on our server. Neither half can decrypt the secret alone — both are needed, momentarily, only to generate the live 6-digit code. Revoking a teammate deletes the server's half, making their half useless instantly.
No passwords to leak — we use magic links and Google sign-in via Supabase. Payments are handled by Stripe; we never receive card data, only a customer ID to identify your plan. All traffic is HTTPS/TLS, and the extension only talks to api.otpilot.app.
See also our Privacy Policy.