What Is the Secure Enclave, and Why It Matters for Your Vault

Encryption is only as strong as the secret at its center. A vault can use the best algorithms in the world, but if the key that unlocks it is sitting in ordinary memory where any app or attacker can grab it, the lock is decorative. So the real question behind "is my data safe?" is quieter and more specific: where is the key, and who can reach it?

On today's iPhones, iPads, and Macs the answer is the Secure Enclave. On Android it is the Keystore. These are not marketing names for software. They are dedicated hardware whose entire job is to hold keys somewhere the rest of the device cannot follow.

What the Secure Enclave actually is

The Secure Enclave is a small, isolated processor built into Apple's chips, walled off from the main system it runs alongside. It has its own memory and its own strict rules. When it creates a key, that key is born inside the chip and is designed never to leave in a form anything outside can read. Instead of handing keys out, the Enclave does the sensitive work itself: give it something to unwrap, and it returns the result, but not the key.

Android devices provide the same idea through the Android Keystore, frequently backed by dedicated hardware. Same principle, different name: keep the key in a place the operating system, other apps, and an attacker with a copy of the disk simply cannot reach.

Why hardware makes the difference

Imagine two ways to protect a safe. In the first, the combination is written on a sticky note taped inside a drawer near the safe. In the second, the combination lives inside a sealed box that will open the safe for you but will never tell you the number. Copy the whole room and the first safe is yours; the second is still locked.

Copying the encrypted files does not copy the ability to open them, because the key was never in the files to begin with.

That is the security property a hardware key store gives you. An attacker who clones the storage of a lost or stolen phone gets a pile of encrypted data and no way to turn it back into documents, because the key that would do it stayed sealed in silicon that did not come along.

How biometric unlock ties in

The hardware also gates when a key can be used. When you unlock with Face ID or Touch ID, you are not sending a fingerprint image to an app. The biometric check happens in the secure hardware, and only a successful match lets the chip use the key it is guarding. This is why a well-built vault can insist on a fresh biometric check before it reveals a sensitive item: the requirement is enforced by the chip, not merely requested by the app. In a password manager, that same mechanism is what gates every AutoFill and every 2FA code behind Face ID or Touch ID.

Why this makes on-device encryption trustworthy

On-device, or zero-knowledge, encryption means your data is encrypted with a key only you hold, so the app maker cannot read it. That promise is only as good as the place the key is kept. Wrap the key in the Secure Enclave or Android Keystore and the promise gains teeth: there is no server-side copy, and no easy way to extract the local one either. The design and the hardware reinforce each other.

This is precisely how Kinship Vault is built. Your master key is generated on your device and sealed in its secure hardware, the Secure Enclave on Apple devices and the Keystore on Android. Every document, photo, and password gets its own key underneath it, and there is no Kinship Vault server that holds your vault or any master password on our side to reset. You can read the full architecture in the security documentation.

The short version

Strong encryption needs a strong place to keep the key. The Secure Enclave and Android Keystore are that place: dedicated hardware that holds your key, uses it without exposing it, and refuses to let it be copied away. It is the quiet foundation that lets an on-device vault promise that even its maker cannot open it, and mean it.