Back to Home
Security
How Finderlock protects your files — the encryption, where keys live, and what we can (and can't) access.
Encryption
- Files and folders are protected inside AES-256 encrypted disk images (macOS native sparse bundles created with hdiutil).
- Finderlock does not implement its own cryptography — it relies on the proven, audited encryption built into macOS.
- The same AES-256 encryption applies on every plan, including the free plan. Paid plans add convenience features, not stronger encryption.
Key storage
- Passwords are never stored in plaintext. Per-item passwords are kept in the macOS Keychain.
- Touch ID protection uses a Keychain key gated by SecAccessControl with biometryCurrentSet, backed by the Secure Enclave on supported Macs.
- A master password (optional) gates sensitive operations and is stored only in the Keychain.
Local-first by design
- Encryption, locking, and unlocking happen entirely on your Mac. Files are not sent to our servers.
- iCloud and Google Drive backup are optional and off until you enable them. When enabled, only the already-encrypted container is backed up.
- Network access is limited to license activation, update checks, optional analytics (opt-in), and optional cloud backup.
Zero-knowledge recovery
- Finderlock cannot access your encrypted files or recover your password. Keys are derived from your credentials and stored locally.
- If you lose your password, protected files cannot be recovered — not even by us. Keep your password safe (a password manager is recommended).
Distribution & integrity
- The app and its installer are signed with an Apple Developer ID certificate and notarized by Apple, so macOS Gatekeeper can verify the download has not been tampered with.
- Finderlock runs inside the macOS App Sandbox with a minimal set of entitlements.
Have a security question or want to report an issue? Email support@finderlock.com.