Salutis uses a local-first architecture: documents remain in the vault folder you choose, and no cloud service is required to encrypt or open them. When vault encryption is enabled, the app derives a 256-bit key from your passphrase with PBKDF2-SHA256 and encrypts each file before it reaches the disk using AES-256-GCM. A unique random IV prevents identical files from producing identical ciphertext, while the authentication tag detects a wrong key or any change to the encrypted data.
passphrase + 32 B salt
PBKDF2-SHA256 · 100,000
256-bit key · memory only
file bytes + random 16 B IV
AES-256-GCM
IV | auth tag | ciphertext
If you have found a security weakness in Salutis, please tell us. We would rather hear it from you than from someone exploiting it. Reports are welcome from anyone, and you do not need an account or a licence to send one.
How to report
Email security@salutis.app. This address is read by the maintainer of Salutis and is used only for security reports.
Please include, as far as you can: what the problem is, the version of Salutis and the operating system you used, the steps to reproduce it, and what an attacker could obtain. A proof of concept helps, screenshots help, and a rough guess at the impact helps even if you are not sure it is right.
What happens next
We acknowledge every report within 72 hours. Within 10 working days we tell you whether we could reproduce the problem, how we rate its severity, and when we expect to fix it. We keep you informed while the work is in progress, and we tell you when the fix ships.
Fixes are released as soon as they are ready. For serious problems we publish a security update outside the normal release schedule.
Disclosure
We ask you to give us 90 days before making a report public, or less if we ship a fix sooner. We will credit you by name in the release notes unless you prefer otherwise. If a vulnerability is already being exploited, we notify the competent authorities as required by Regulation (EU) 2024/2847 (the Cyber Resilience Act) and inform affected users without undue delay.
What is in scope
The Salutis desktop application, the Salutis mobile companion app, this website, and the services that issue and verify licences. Salutis stores health documents on your own computer, so weaknesses that expose the contents of a vault, defeat its encryption, or let one account read another account's licence data are the ones we care about most.
Out of scope: reports produced by automated scanners with no demonstrated impact, missing security headers with no exploitable consequence, denial of service through traffic volume, social engineering of the maintainer, and issues in third party services we do not control.
Testing safely
Please test only against your own installation and your own data. Do not access, modify or delete data belonging to other people, do not degrade the service for others, and do not run automated scans against our infrastructure. If you follow these rules while researching in good faith, we will not pursue legal action against you and we will treat your report as authorised testing.
Security updates
Salutis Pro is sold as a one time licence with twelve months of new features. Security updates are separate from that period: we provide them for five years from the date of purchase, as required by the Cyber Resilience Act, regardless of whether the feature period has ended.
Contact
Security reports: security@salutis.app
Everything else: info@salutis.app