How we protect your documents

« Your documents, filed and encrypted. Impossible to lose. Impossible to read - even for us. »

La Pochette - Last updated: 25 July 2026

Everything our servers know about you

Everyone promises that "your data is encrypted". So rather than promise it, we show you. Here is, table by table, what our database holds for an account and its documents. There is nothing else.

Your account

lapochette=> SELECT * FROM users WHERE email = 'demo@la-pochette.fr';

            id             |        email        | email_verifie |              password_hash               |  plan   |       cree_le
---------------------------+---------------------+---------------+------------------------------------------+---------+---------------------
 cmcz1k7xq0000v8m3f2qhd41x | demo@la-pochette.fr | t             | $argon2id$v=19$m=65536,t=3,p=4$Yk1t[...] | gratuit | 2026-07-08 14:21:07

Your backed-up documents

lapochette=> SELECT * FROM blobs WHERE user_id = 'cmcz1k7xq0000v8m3f2qhd41x';

            id             |          user_id          | taille_octets | version |            checksum             |       cree_le
---------------------------+---------------------------+---------------+---------+---------------------------------+---------------------
 cmd4p2ne10041kx7w9e2rbn5t | cmcz1k7xq0000v8m3f2qhd41x |        412876 |       1 | 9f2ac471d9035eb644fa21c8[...] | 2026-07-08 14:23:41
 cmd4p3rk80042hs6d1u8ypm3q | cmcz1k7xq0000v8m3f2qhd41x |        268503 |       1 | 4b0a57c16e942b88d31f7ae5[...] | 2026-07-08 14:25:02

The content of a "document", as seen from our side

$ hexdump -C blob-cmd4p2ne10041kx7w9e2rbn5t | head -5

00000000  01 00 00 00 02 00 03 27  3d 01 00 00 00 49 8f 2a  |.......'=....I.*|
00000010  c4 71 d9 03 5e b6 44 fa  21 c8 90 3d 6b e2 17 aa  |.q..^.D.!..=k...|
00000020  05 9c f4 51 b8 0e 63 d7  2f 4b a9 86 10 f5 3c e8  |...Q..c./K....<.|
00000030  72 bd 09 57 c1 6e 94 2b  88 d3 1f 7a e5 40 ac 68  |r..W.n.+...z.@.h|
00000040  f9 15 82 cf 3b 91 56 e0  24 a7 0d 74 c9 3e 8b 52  |....;.V.$..t.>.R|

Your vault index (titles, categories, dates)

lapochette=> SELECT * FROM index_coffre WHERE user_id = 'cmcz1k7xq0000v8m3f2qhd41x';

          user_id          |              blob_index_chiffre              | version |       maj_le
---------------------------+----------------------------------------------+---------+---------------------
 cmcz1k7xq0000v8m3f2qhd41x | \x01e64b09c21a77f0d3985c4be12a06fd39c7[...] |       4 | 2026-07-16 19:42:18
What you will not find anywhere above: your key. It was born on your phone and has never left it. Without it, these bytes are mathematically undecipherable - to an attacker, to an employee, to us. We are not "promising" not to look: we cannot.

The schema (tables, columns) is exactly the one in our production database; the values shown are those of a demonstration account, reproduced in the real format. What remains outside the database: technical anti-abuse logs (IP address, no content), detailed in the privacy policy.

"Unreadable, even to us"

Your documents are locked on your phone, before being backed up online. What reaches our servers is a closed padlock we do not have the key to: we are technically unable to open your files, not merely bound not to.

For the technically minded
  • End-to-end, client-side encryption: content, recognised text (OCR), titles and categories are encrypted on the device (XChaCha20-Poly1305, libsodium).
  • The server only stores opaque blobs + an encrypted index. The only metadata in the clear: user id, blob id, size, version, timestamp - see the database excerpt above.
  • Text recognition and category suggestion happen 100% on the device - no third-party AI, no plain text ever transits, ever.

Even stolen, the phone will not talk

The app's files stay encrypted on the phone's storage. Without the app and without your biometrics, they are nothing but unreadable data.

For the technically minded
  • Files and local database encrypted at rest (SQLCipher).
  • Keys stored in the phone's hardware vault (iOS Keychain / Android Keystore), access protected by biometrics or the device passcode.
  • Standard, battle-tested algorithms: XChaCha20-Poly1305 (libsodium) - no home-made cryptography.

Your key, and its backup

A single key protects your whole vault. It is drawn at random on your phone when you create the vault - it depends neither on your email nor on your password, and it is never transmitted to us.

Since it is the only way in, the app makes you save a recovery key (a code + a QR, exportable as a PDF to your files, your password manager or a printout) - and will not let you continue until you have confirmed it is done.

For the technically minded
  • Random 256-bit master key, never derived from the email or the password.
  • Envelope encryption: each document has its own file key, itself encrypted by the master key → rotation is possible without re-encrypting everything.
  • The recovery key is the master key, encoded (readable code + QR), to be kept off the device; explicit confirmation is required when the vault is created.

A blind online backup

The backup runs on its own, continuously, but the server never sees anything intelligible. It behaves like a bank vault whose combination only you hold: it keeps your belongings without being able to open them, or even know what is inside. Phone lost or broken? On the new one: sign in, scan (or type) your recovery key, and the vault is restored in full.

For the technically minded
  • Automatic upload of encrypted blobs (Wi-Fi by default, 4G/5G optional), offline queue, backup status visible per document.
  • The vault index (titles, categories, dates) is a single blob encrypted client-side, opaque to the server.
  • The app stays 100% functional offline; the network is only used for the backup.

The account protects the account, never the vault

Two different things: signing in to your account (email + password) and opening your vault (the key). The password and the email only serve to manage the account and prevent abuse - they never give access to your documents.

For the technically minded
  • The password is for server authentication only (hashed with Argon2id). It takes no part in any key derivation.
  • Losing the password ≠ losing the data. There is no "vault recovery by email" - that would be a back door.

Importing from a computer

To send a file from your PC to the app, your browser encrypts it on your computer with a single-use key handed to the phone through the QR code only - never through our servers. The encrypted file passes through a temporary buffer, the phone fetches it, decrypts it, then files it in the vault.

For the technically minded
  • Ephemeral session key (256-bit) generated in the browser; the server never sees it (visual channel of the QR code).
  • File encrypted with XChaCha20-Poly1305; metadata (name, type, size) encrypted as well; authenticated data bound to the session (anti-replay).
  • Session bound to the account: the phone must be on the same account as the session → neutralises a stolen or booby-trapped QR code.
  • An asterisk we own up to: the file exists in the clear for a brief moment inside the web page, on your PC (it is your browser that encrypts it) - limited to that one file; the rest of the vault and the key never leave the phone.

Day-to-day security

The app locks every time you open it and re-locks on its own if you leave it in the background. Its content is hidden in the app switcher.

For the technically minded
  • Unlock by biometrics (Face ID / Touch ID) or device passcode on every launch.
  • Automatic re-lock after 60 s in the background; preview hidden in the multitasking view.
  • No document content, title or text in the logs, on the app side or the server side - only the strictly technical remains (including the anti-abuse IP address, see the privacy policy).

A server hardened against abuse

Even though it cannot read your documents, our server is seriously protected against attacks and bots.

For the technically minded
  • HTTPS everywhere, security headers, rate limiting per IP and per account.
  • Argon2id passwords, short access tokens + rotating refresh tokens (with replay detection).
  • Protected sign-up: email verification by code + anti-bot captcha.
  • Hosted in France (OVH), emails via Scaleway (France), daily server backups. No data outside the European Union.

What we never do

Some things are ruled out by design, not by a mere promise.

The detail
  • No cloud AI or third-party API ever sees your documents.
  • No advertising trackers, no invasive third-party analytics.
  • No back door: we cannot decrypt a vault, so there is no "assisted recovery". Saving your key is the only way in - this is deliberate, and stated plainly.
  • No phone number collected (GDPR data minimisation).

Do not take our word for it: check

A security promise you cannot test is worth nothing. Here are three checks you can run yourself, without asking us for anything.

Switch to airplane mode. Scan, search, file, open your documents: everything works, in full, with no network. If our servers were reading your documents to process them, this would be impossible. The network is only used to upload encrypted blobs.
Export everything, free of charge. The full export of your documents (zip) is free, for everyone, forever. Your data is never held hostage: you can leave at any time, with all of it. An app that intends to keep you does not offer that.
Look for what we do not ask you. No phone number, no name, no address: an email is enough. No sensitive permission: the camera - to scan - and biometrics - to lock. No contacts, no location, no microphone. No advertising trackers, no third-party analytics.

The trade-off, owned up to - and why it should reassure you

The flip side of encryption this strict: if you lose both your phone and your recovery key, no one will be able to restore your documents - not even us. That is the price of "unreadable, even to us", and we would rather tell you in large type than in small print.

This trade-off is also your best guarantee: a service that can "get your documents back if you lose everything" is a service that can read them - and that can therefore be hacked, compelled or corrupted. If we offered that convenience, our promise would be a lie. We never will.

What we protect you from - and what we cannot

No security protects against everything. Saying exactly where ours stops is worth more than a blanket promise: it lets you judge whether it fits your situation.

Protected

  • Phone lost, stolen or broken. The vault restores onto a new device, and whoever finds the old one gets nothing out of it.
  • Server hacked, seized or subpoenaed. All it holds is encrypted blocks and your email. The key is not with us.
  • An employee, a contractor, us. Nobody can open a document: that is not an internal rule, it is a technical impossibility.
  • Password guessed or leaked. It opens the account, never the vault - two different locks.
  • Us, if we ever changed. Everything works offline and the full export is free: you can leave whenever you want, with everything.

Not protected

  • A compromised phone. Spyware, jailbroken or rooted device: whatever you can read on screen, malicious software running on that device can read too.
  • Someone who has your passcode or your face. Our lock builds on the phone's own: whoever can unlock it can open the app.
  • Anything that leaves the app. A document shared, printed, screenshotted or exported is no longer under our protection - it becomes an ordinary file again.
  • A flaw in the operating system or a third-party component. We keep up with updates, but we write neither iOS, nor Android, nor the libraries we rely on.
  • Phone and recovery key lost together. Nothing and no one can restore the vault. That is the trade-off described above.

Who is behind all this?

Knowing who you hand your documents to is part of security. La Pochette is published by Hermitech - Damien Diep, a sole trader based in Corsica, France. One person, no venture capital, no shareholders: the service lives on its subscriptions, never on your data. Full details, company number and host: legal notice.

Found a vulnerability?

Write to us at contact@hermitech.fr. We acknowledge receipt within 5 working days and keep you posted on the fix. We have no bounty programme - this is an independent project - but every serious report is handled as a priority, and credited publicly if you wish.

Machine-readable contact details: /.well-known/security.txt (RFC 9116).

Frequently asked questions

Can you read my documents if a court asks? We can only hand over what we have - exactly what the black box at the top of this page shows: your email and encrypted blobs with their sizes and dates. Never the content: we do not have the key to open it. This is not a refusal, it is a technical impossibility.
What happens if I lose my password? You recover your account by email, and your documents do not move: it is your key that protects them, not your password (see section 5).
And if I lose my recovery key? As long as you have your phone, nothing is lost: the app lets you display and export your key again (after authentication). If you lose the phone AND the key: see "The trade-off, owned up to".

Convinced?

Your papers can be filed - and unreadable to us - by tonight.

Download the app iOS and Android