How we protect your documents

« Your documents, filed and encrypted. Impossible to lose. Impossible to read - even for us. »

La Pochette - Last updated: 18 July 2026

Everything our servers know about you

Everyone promises that "your data is encrypted". So rather than promise it, we show you. Here is, table by table, what our database holds for an account and its documents. There is nothing else.

Your account

lapochette=> SELECT * FROM users WHERE email = 'demo@la-pochette.fr';

            id             |        email        | email_verifie |              password_hash               |  plan   |       cree_le
---------------------------+---------------------+---------------+------------------------------------------+---------+---------------------
 cmcz1k7xq0000v8m3f2qhd41x | demo@la-pochette.fr | t             | $argon2id$v=19$m=65536,t=3,p=4$Yk1t[...] | gratuit | 2026-07-08 14:21:07

Your backed-up documents

lapochette=> SELECT * FROM blobs WHERE user_id = 'cmcz1k7xq0000v8m3f2qhd41x';

            id             |          user_id          | taille_octets | version |            checksum             |       cree_le
---------------------------+---------------------------+---------------+---------+---------------------------------+---------------------
 cmd4p2ne10041kx7w9e2rbn5t | cmcz1k7xq0000v8m3f2qhd41x |        412876 |       1 | 9f2ac471d9035eb644fa21c8[...] | 2026-07-08 14:23:41
 cmd4p3rk80042hs6d1u8ypm3q | cmcz1k7xq0000v8m3f2qhd41x |        268503 |       1 | 4b0a57c16e942b88d31f7ae5[...] | 2026-07-08 14:25:02

The content of a "document", as seen from our side

$ hexdump -C blob-cmd4p2ne10041kx7w9e2rbn5t | head -5

00000000  01 00 00 00 02 00 03 27  3d 01 00 00 00 49 8f 2a  |.......'=....I.*|
00000010  c4 71 d9 03 5e b6 44 fa  21 c8 90 3d 6b e2 17 aa  |.q..^.D.!..=k...|
00000020  05 9c f4 51 b8 0e 63 d7  2f 4b a9 86 10 f5 3c e8  |...Q..c./K....<.|
00000030  72 bd 09 57 c1 6e 94 2b  88 d3 1f 7a e5 40 ac 68  |r..W.n.+...z.@.h|
00000040  f9 15 82 cf 3b 91 56 e0  24 a7 0d 74 c9 3e 8b 52  |....;.V.$..t.>.R|

Your vault index (titles, categories, dates)

lapochette=> SELECT * FROM index_coffre WHERE user_id = 'cmcz1k7xq0000v8m3f2qhd41x';

          user_id          |              blob_index_chiffre              | version |       maj_le
---------------------------+----------------------------------------------+---------+---------------------
 cmcz1k7xq0000v8m3f2qhd41x | \x01e64b09c21a77f0d3985c4be12a06fd39c7[...] |       4 | 2026-07-16 19:42:18
What you will not find anywhere above: your key. It was born on your phone and has never left it. Without it, these bytes are mathematically undecipherable - to an attacker, to an employee, to us. We are not "promising" not to look: we cannot.

The schema (tables, columns) is exactly the one in our production database; the values shown are those of a demonstration account, reproduced in the real format. What remains outside the database: technical anti-abuse logs (IP address, no content), detailed in the privacy policy.

"Unreadable, even to us"

Your documents are locked on your phone, before being backed up online. What reaches our servers is a closed padlock we do not have the key to: we are technically unable to open your files, not merely bound not to.

For the technically minded
  • End-to-end, client-side encryption: content, recognised text (OCR), titles and categories are encrypted on the device (XChaCha20-Poly1305, libsodium).
  • The server only stores opaque blobs + an encrypted index. The only metadata in the clear: user id, blob id, size, version, timestamp - see the database excerpt above.
  • Text recognition and category suggestion happen 100% on the device - no third-party AI, no plain text ever transits, ever.

Even stolen, the phone will not talk

The app's files stay encrypted on the phone's storage. Without the app and without your biometrics, they are nothing but unreadable data.

For the technically minded
  • Files and local database encrypted at rest (SQLCipher).
  • Keys stored in the phone's hardware vault (iOS Keychain / Android Keystore), access protected by biometrics or the device passcode.
  • Standard, battle-tested algorithms: XChaCha20-Poly1305 (libsodium) - no home-made cryptography.

Your key, and its backup

A single key protects your whole vault. It is drawn at random on your phone when you create the vault - it depends neither on your email nor on your password, and it is never transmitted to us.

Since it is the only way in, the app makes you save a recovery key (a code + a QR, exportable as a PDF to your files, your password manager or a printout) - and will not let you continue until you have confirmed it is done.

For the technically minded
  • Random 256-bit master key, never derived from the email or the password.
  • Envelope encryption: each document has its own file key, itself encrypted by the master key → rotation is possible without re-encrypting everything.
  • The recovery key is the master key, encoded (readable code + QR), to be kept off the device; explicit confirmation is required when the vault is created.

A blind online backup

The backup runs on its own, continuously, but the server never sees anything intelligible. It behaves like a bank vault whose combination only you hold: it keeps your belongings without being able to open them, or even know what is inside. Phone lost or broken? On the new one: sign in, scan (or type) your recovery key, and the vault is restored in full.

For the technically minded
  • Automatic upload of encrypted blobs (Wi-Fi by default, 4G/5G optional), offline queue, backup status visible per document.
  • The vault index (titles, categories, dates) is a single blob encrypted client-side, opaque to the server.
  • The app stays 100% functional offline; the network is only used for the backup.

The account protects the account, never the vault

Two different things: signing in to your account (email + password) and opening your vault (the key). The password and the email only serve to manage the account and prevent abuse - they never give access to your documents.

For the technically minded
  • The password is for server authentication only (hashed with Argon2id). It takes no part in any key derivation.
  • Losing the password ≠ losing the data. There is no "vault recovery by email" - that would be a back door.

Importing from a computer

To send a file from your PC to the app, your browser encrypts it on your computer with a single-use key handed to the phone through the QR code only - never through our servers. The encrypted file passes through a temporary buffer, the phone fetches it, decrypts it, then files it in the vault.

For the technically minded
  • Ephemeral session key (256-bit) generated in the browser; the server never sees it (visual channel of the QR code).
  • File encrypted with XChaCha20-Poly1305; metadata (name, type, size) encrypted as well; authenticated data bound to the session (anti-replay).
  • Session bound to the account: the phone must be on the same account as the session → neutralises a stolen or booby-trapped QR code.
  • An asterisk we own up to: the file exists in the clear for a brief moment inside the web page, on your PC (it is your browser that encrypts it) - limited to that one file; the rest of the vault and the key never leave the phone.

Day-to-day security

The app locks every time you open it and re-locks on its own if you leave it in the background. Its content is hidden in the app switcher.

For the technically minded
  • Unlock by biometrics (Face ID / Touch ID) or device passcode on every launch.
  • Automatic re-lock after 60 s in the background; preview hidden in the multitasking view.
  • No document content, title or text in the logs, on the app side or the server side - only the strictly technical remains (including the anti-abuse IP address, see the privacy policy).

A server hardened against abuse

Even though it cannot read your documents, our server is seriously protected against attacks and bots.

For the technically minded
  • HTTPS everywhere, security headers, rate limiting per IP and per account.
  • Argon2id passwords, short access tokens + rotating refresh tokens (with replay detection).
  • Protected sign-up: email verification by code + anti-bot captcha.
  • Hosted in France (OVH), emails via Scaleway (France), daily server backups. No data outside the European Union.

What we never do

Some things are ruled out by design, not by a mere promise.

The detail
  • No cloud AI or third-party API ever sees your documents.
  • No advertising trackers, no invasive third-party analytics.
  • No back door: we cannot decrypt a vault, so there is no "assisted recovery". Saving your key is the only way in - this is deliberate, and stated plainly.
  • No phone number collected (GDPR data minimisation).

Do not take our word for it: check

A security promise you cannot test is worth nothing. Here are three checks you can run yourself, without asking us for anything.

Switch to airplane mode. Scan, search, file, open your documents: everything works, in full, with no network. If our servers were reading your documents to process them, this would be impossible. The network is only used to upload encrypted blobs.
Export everything, free of charge. The full export of your documents (zip) is free, for everyone, forever. Your data is never held hostage: you can leave at any time, with all of it. An app that intends to keep you does not offer that.
Look for what we do not ask you. No phone number, no name, no address: an email is enough. No sensitive permission: the camera - to scan - and biometrics - to lock. No contacts, no location, no microphone. No advertising trackers, no third-party analytics.

The trade-off, owned up to - and why it should reassure you

The flip side of encryption this strict: if you lose both your phone and your recovery key, no one will be able to restore your documents - not even us. That is the price of "unreadable, even to us", and we would rather tell you in large type than in small print.

This trade-off is also your best guarantee: a service that can "get your documents back if you lose everything" is a service that can read them - and that can therefore be hacked, compelled or corrupted. If we offered that convenience, our promise would be a lie. We never will.

Frequently asked questions

If you get hacked, do my documents leak? No: an attacker would get what the black box above shows - encrypted blobs and file sizes. Unusable without your key, which is not with us.
Can you read my documents if a court asks? We can only hand over what we have - exactly what the black box above shows: your email and encrypted blobs with their sizes and dates. Never the content: we do not have the key to open it. This is not a refusal, it is a technical impossibility.
Can a La Pochette employee take a look? No: even with full access to the servers, no content is readable - which is precisely what the database excerpt at the top of this page shows.
What happens if I lose my password? You recover your account by email; your documents stay protected by your key (see section 5). Losing the password never puts your documents at risk.
And if I lose my recovery key? As long as you have your phone, nothing is lost: the app lets you display and export your key again (after authentication). If you lose the phone AND the key: see "The trade-off, owned up to".