Open Source ≠ Proof of Security: How Should You Judge a Digital Vault?

Someone recently asked us a fair question:

"Soult isn't open source. So how do I know it is secure?"

It is exactly the kind of question we want people to ask. Soult is being built as the World's First Secure Digital Life Vault, and that creates an obligation to explain how we think about security — not to ask anyone to take our word for it.

Open source is genuinely valuable. It lets people inspect code, challenge it and find weaknesses. But source code is only one part of a much larger security system, and "open source" has quietly come to be treated as a synonym for "secure." Those are not the same thing.

Is Soult open source?

Soult is proprietary today. That decision is partly commercial, but it is also connected to security-related intellectual property we are developing and protecting — including our patent-stage Chakra architecture.

But proprietary cannot mean "trust us, we know what we're doing." Trust has to be earned through architecture, encryption, key management, infrastructure security, testing, privacy controls, compliance and independent validation. That is the standard we are building towards.

What source code cannot tell you by itself

Being able to inspect code can reveal a great deal about how software has been designed. But a production service is far more than its application code. Inspecting a repository does not automatically tell you:

• What is actually running in production. The deployed version, configuration and dependencies may differ from the code someone inspected.
• How encryption keys are handled. Strong cryptography can still be weakened by poor key storage, excessive access or weak operational controls.
• How the cloud environment is configured. Storage permissions, network configuration, privileged accounts, backups and monitoring all sit outside the question of whether the application source is public.
• Who inside the organisation has access. Security depends on access controls, separation of duties, logging and how administrative privileges are governed.
• How recovery works. A system can be extremely hard to breach and still fail its users if losing one credential means losing years of important information permanently.
• How vulnerabilities are handled. Finding weaknesses is only half the job — organisations need processes to assess, prioritise, patch and verify them.
• How incidents are detected and managed. Monitoring, response procedures, audit trails and learning from failures all matter.

This is why asking only "Is it open source?" is too narrow. The stronger question is: what evidence does this product provide that the complete system protecting my information has been designed, operated and tested securely?

The security stack we believe matters

For a product like Soult, we look at security as a stack, where a weakness in any important layer can affect everything above it:

Architecture → Encryption → Key Management → Infrastructure → Access Control → Recovery → Testing → Privacy → Compliance → Independent Validation

Open source can strengthen one part of that picture — transparency and scrutiny. It should not become a substitute for examining everything else, and being proprietary should never become an excuse for avoiding scrutiny.

Why the vault is not one single lock

A Soult vault may hold financial information, documents, passwords, medical wishes, information about loved ones, memories and things intended to reach family someday. These are not all the same kind of data, and they should not all be protected in exactly the same way.

The strongest lock is not automatically the right lock for every door. Soult therefore uses purpose-built compartments and applies different security and recovery models depending on what the information is and why it exists. Our Password Keeper, for example, uses client-side encryption, while appropriate recoverable information can use a different model backed by AWS KMS. Security and continuity have to coexist.

The question to ask instead

Whether you are evaluating Soult, a password manager, a financial application or any product holding sensitive information, ask:

• Where is my information encrypted?
• Who controls the keys?
• What can the service provider itself access?
• What happens if I lose my credentials?
• How is the production environment protected?
• Who has administrative access?
• How is the product tested?
• How are vulnerabilities and incidents handled?

Those questions reveal far more than a single badge saying Open Source or Encrypted.

Want to examine Soult's security approach more closely?

We do not expect anyone to trust a Digital Life Vault because of a marketing claim. Soult is being built as the World's First Secure Digital Life Vault, and we believe that creates an obligation to explain how we think about security, privacy, access and continuity.

Our Security Whitepaper goes deeper into the architecture and security principles behind the vault.

Explore the Soult Security Whitepaper →

Ask us the difficult questions. We would rather earn trust than ask for it.