Kistvault keeps everything on your device, which is exactly why nothing of yours sits on someone else's server. The honest flip side: a lost or broken phone could mean lost data — unless you keep your own backup. Good news: the backup is just a file, and it's already encrypted.
The routine
- Export the container. Do it while the vault is locked — the archive is opaque ciphertext, so exporting it can't leak anything.
- Keep more than one copy. A classic rule of thumb: a couple of copies, on different media — say an external drive and your own cloud. Since the container is ciphertext, even an untrusted cloud only ever sees scrambled bytes.
- Store your Recovery Kit separately. The container is the data; the Kit (or your password) is the key. Keep them apart so one compromised location doesn't hand over both.
- Refresh after big changes. Re-export after you add a batch of important files, so your backup isn't far behind your vault.
Why this is safe
The export is pure ciphertext — opening it still requires your credential or Kit, and its integrity is authenticated by the header MAC and per-chunk AEAD inside it. Putting the container somewhere convenient doesn't weaken it; it's the same protection as on your phone.
The point: no hostage data. Your backup is a file you control, not a subscription that controls your access.