Features Security How it works For Professionals Pricing About Blog
Security & Privacy

We store ciphertext.
We cannot read your data.

Zero-knowledge encryption means your vault is encrypted on your device with a key only you hold. Not even Sudden has the ability to read what you've stored. This is the only architecture we trust with information this sensitive.

AES-256-GCM Encryption
ICO Registered
UK GDPR Compliant
Registered in England & Wales
Zero-Knowledge Architecture
PBKDF2 Key Derivation
WHAT GETS STORED IN OUR DATABASE
AES-GCM ciphertext (unreadable)
Initialisation vector (non-sensitive)
Encrypted email address
Your readable encryption key — never
Plaintext vault data — never
Your password — never, ever
How it works

Zero-knowledge, explained simply

Your password and a unique salt generate an encryption key — on your device only. That key encrypts your data before it ever leaves your phone. What reaches our servers is scrambled nonsense. Only your device can unscramble it.

Your password
Never leaves your device
+
Unique salt
Stored on device only
→
PBKDF2 derivation
100,000 iterations
→
AES-256 key
Stored securely on your device
→
Ciphertext only
This is what we store
How your data stays yours

The short version

01
Encrypted before it leaves your device
Every vault field is encrypted with AES-256-GCM before it ever leaves your device, using a key derived from your password (PBKDF2, 100,000 iterations, SHA-256). Your encryption key is stored securely on your device and loaded into memory when you unlock your vault. We never receive a readable copy of it: if you share with a trusted contact, our servers hold only an encrypted, wrapped version of the key, which we cannot unlock. We only ever store ciphertext, and it's unreadable to us.
02
Locked behind Face ID or fingerprint
After your first login, Face ID or fingerprint unlocks your vault. That biometric data never leaves your device — it's processed entirely by iOS or Android's secure enclave. We cannot access it. No one can.
03
Protected at the database level, not just the app
Our database enforces row-level security, so every query is checked against your authenticated identity before any data comes back — even a bug in our app code couldn't return someone else's records. Sessions use short-lived tokens, and if you return to the app after more than two minutes away, it locks again and asks you to unlock it before showing your vault.

On top of all this: UK GDPR compliance, ICO registration, and your right to erasure — covered in full below.

Compliance

Built to be trusted

UK GDPR
Full compliance with UK data protection law. Lawful basis for processing documented. Data minimisation in practice. Your rights — access, erasure, portability — honoured without friction.
ICO Registered
Registered with the Information Commissioner's Office as required by UK law (registration no. ZC144642). Annual renewal maintained.
Registered in England & Wales
Sudden Ltd is incorporated in England and Wales. UK-based legal structure, UK law applies, UK courts have jurisdiction.
NIST-standard cryptography
AES-256-GCM for symmetric encryption. PBKDF2-SHA256 for key derivation. Industry-standard algorithms, no proprietary cryptography.
Right to erasure
Delete your account and your vault and account data are permanently removed from our live systems within 30 days. Encrypted copies may remain in backups after deletion, and stay unreadable to us. Basic billing records are kept for seven years, as UK law requires.
No data sharing
We do not sell, license, or share your personal data with third parties for marketing or analytics. What you store in Sudden is yours alone.

Privacy by design. Not by promise.

We built zero-knowledge encryption because a platform storing this information has a responsibility to ensure it cannot be compromised — even by us.

Your data is locked before it's saved  ·  ICO registered  ·  UK GDPR compliant  ·  Delete your data any time

Sudden — Early Access
Free to start · No credit card required