Local encrypted vault design
Vault content is encrypted in the browser with AES-256-GCM. The key is derived with PBKDF2-SHA-256 using a random salt and 600,000 iterations. The password is not saved by FairFiles Hub.
Evidence-Based Security
Security & Privacy Center
What the application protects, what stays on your device, and which live controls require separate operational evidence.
Clear claims. No unverified security promises.
No website is perfectly secure
FairFiles Hub does not claim to be unhackable, breach-proof, independently penetration-tested, or compliant merely because a feature appears on this page. Source controls, Base44 organization settings, production hosting, staff practices, monitoring, and third-party testing require different evidence.
Verified in this source package
These statements are limited to inspected code and completed repository checks.
Local-first case tools
The active Forms Library, calculators, and Letter Builder do not upload completed forms, financial figures, letter answers, credit reports, or evidence to FairFiles Hub.
Route and role guards
Member routes require authentication in the application, and administrator pages require the Base44 admin role. Backend entity rules remain the final enforcement layer.
Release dependency checks
This source package passed its production build, lint, JavaScript type check, and npm dependency audit with zero known audit findings at the audit date.
Where sensitive files belong
Credit reports, government IDs, Social Security documents, full statements, court files, evidence, and completed letters should remain on a device, USB drive, external drive, mounted NAS, or other storage controlled by the user. The Local Vault can package selected files in encrypted form. FairFiles Hub cannot recover a forgotten vault password or lost local file.
Required live verification before stronger claims
An administrator should retain dated evidence for every item below and recheck it after material changes.
- Production-domain TLS, HTTPS redirects, HSTS, and response security headers
- Staff MFA/SSO enforcement, session policy, and recovery procedures
- Production authorization tests using two separate member accounts plus an administrator
- Centralized audit logs, alert routing, retention, and incident-response exercises
- Backup restoration tests for the minimum server data that remains
- Independent third-party penetration testing and documented remediation
Your part in protecting data
- Use a unique account password and MFA when the authentication provider offers it.
- Keep the operating system and browser updated.
- Use a long, unique Local Vault password stored in a reputable password manager.
- Maintain at least one encrypted backup and test that it opens.
- Never enter a full Social Security number, password, full account number, or complete case file into the Credit Education Assistant.
- Verify external domains before entering sensitive information.
Report a suspected security issue to security@fairfilehub.com. For privacy requests, contact privacy@fairfilehub.com.
Last source review: July 22, 2026. This date is not proof of a live penetration test or production configuration review.