Products / Documents & files

Hoq Vault

Files sealed under your own passphrase. While sealed, nobody at Hoq can read them.

Open Hoq VaultLive11 featuresvault.hoq.app

What it does

A vault is a space in Hoq Storage that you seal with your own key. Inside, it works like the rest of your drive: folders, tags, versions, thumbnails and share links.

When you seal it, the file names, folders and contents are encrypted with AES-256-GCM and our server forgets the key. Each file gets its own key, wrapped under the vault key. A sealed vault shows one line: its label, its size and when it was last opened.

You open it with your passphrase, a passkey on your device, or the recovery key you wrote down when you made it. It seals itself 8 hours after you open it unless you set another time. Share links to a sealed vault stop working until you open it again.

While a vault is open, our server holds its key in memory so it can show you your files. Sealing ends that.

In numbers

AES-256GCM encryption, a separate key per file

8 hoursuntil an open vault seals itself, by default

90 daysthe longest you can hold a vault shut

7 daysto change your mind after you delete a vault

Specifications

Encryption	AES-256-GCM. Every file has its own key, and that key is wrapped under the vault key.
Passphrase	Turned into a key with Argon2id (libsodium moderate settings). The passphrase is never stored.
Ways to open it	Passphrase, a passkey on your device, or the recovery key. The recovery key cannot be removed, and the last two ways in cannot be removed.
Recovery key	32 random bytes shown once as 8 groups of 7 characters. Capitals and spaces do not matter when you type it back.
What a sealed vault shows	Its label, size and last open. No file count, no names, no folder tree, no thumbnails.
Auto-seal	8 hours after you open it by default. You choose the time when you make the vault.
Wrong guesses	8 unlock attempts per 15 minutes from one address, then it waits.
Hold until a date	Seal it until a date up to 90 days out. Your passphrase and passkey are refused until then; only the recovery key opens it early.
Deleting	You must open the vault and type its name. It is sealed and deleted 7 days later. You can cancel without the key.
Share links	Links to a file in a sealed vault answer with a locked page that names nothing.

Features

11 features, all shipped. Listed from the product's code and documentation; each row shows the day it was last checked.

Sealing 4
Seal and unseal	Seal a vault and the server forgets its key; open it with any of your keys.
Sealed index	Names, folders, tags and versions live in an index that is encrypted with the files.
Auto-seal	An open vault seals itself after the time you set, 8 hours by default.
Hold until a date	Lock a vault for up to 90 days so only the recovery key can open it early.

Keys 4
Passphrase	Set when you make the vault, typed twice.
Recovery key	A sheet you must confirm you saved before the vault is made.
Passkeys	Open the vault with Face ID, Touch ID or a security key that supports the WebAuthn PRF extension.
Keys panel	See every way in and remove the ones you no longer use.

Files 3
Same browser as your drive	Folders, tags, versions, thumbnails and quick look work inside an open vault.
Share links	Share a file from an open vault; the link goes dark when the vault seals.
Delete with a grace week	Proof of key and the typed name start a 7-day countdown you can stop.

Works with

Hoq StorageA vault is a space in Hoq Storage and opens in the same file browser.

Your data

Where it is kept	Encrypted objects in our own S3-compatible storage. Blob names are keyed hashes, so even object names say nothing without the key.
Getting it out	Open the vault and download files from the browser. The sealed bundle has two copies of its header, so the format can be read with the key alone.
If you leave	Delete the vault: it seals, waits 7 days, then every object and row is removed.

APIs and standards

HTTP API under /api/files/vaults/{space} with a Hoq ID bearer token (create, unseal, seal, status, hold, passkey slots, delete)
Standard: AES-256-GCM
Standard: Argon2id
Standard: WebAuthn PRF extension
Standard: HKDF

Compared

Checked 2026-11-01	Hoq Vault	Proton Drive Professional	Tresorit Business
Price per user per month	Not published	$9.99¹	not published²
Storage included	Uses your Hoq Storage quota	1 TB per user¹	From 6 TB (2 TB per user, 3 users minimum)²
Largest file	Not published	not published¹	15 GB²
Encryption model	Encrypted on our server; the key is held in memory only while the vault is open	End-to-end encrypted in your app¹	End-to-end encrypted, zero-knowledge²
Lock until a date	Yes, up to 90 days	not published¹	not published²
Data residency choice	Not offered	not published¹	Included on Business²