Security

Built on open standards.

Last reviewed: 9 November 2026

Copia recognizes passwords, API keys from 55+ services, card numbers, crypto recovery phrases and two-factor keys, and never writes them to disk or iCloud. Your history is encrypted with AES-256 and sync is end-to-end encrypted.

Standards we rely on

• Encryption: AES-256-GCM through Apple CryptoKit. Keys are random, kept in the Keychain and never leave your devices unencrypted.
• Sync: Apple CloudKit and iCloud Keychain. Content is encrypted on your Mac before upload.
• Card numbers: ISO/IEC 7812 card number structure with the Luhn check, per card brand and length.
• Recovery phrases: BIP-39 word list and checksum.
• Two-factor keys: RFC 6238 (TOTP) setup keys and otpauth:// links.
• Service keys: formats published by the services themselves, partly adapted from the open-source gitleaks rules.
• Distribution: signed with Developer ID, hardened runtime, notarized by Apple. No third-party libraries.

OWASP MASVS self-assessment

The OWASP MASVS is a widely used security standard for mobile apps. We reviewed Copia against its 24 controls, adapted to macOS. This is our own assessment, not a certification or an independent audit.

• Met (13): secure storage, leak prevention, strong cryptography, extra authentication for sensitive actions, secure network traffic, safe clipboard use, no vulnerable components, input validation, tamper protection (code signing), and all four privacy controls.
• Partly met (5): key rotation, Keychain-bound Touch ID for the Vault (not possible for items synced through iCloud Keychain), hiding revealed values from screen recording, in-app updates, minimum macOS version.
• Not applicable (6): server authentication and certificate pinning (Copia has no servers), WebViews, jailbreak detection and anti-reverse-engineering measures.

The partly met items are on our roadmap.

Report a vulnerability

Please write to flareappsofficl@gmail.com. We'll reply as soon as possible.

Open-source acknowledgements

gitleaks (MIT License, © 2019 Zachary Rice) · BIP-0039 English word list (MIT License, © Marek Palatinus, Pavol Rusnak, Aaron Voisine, Sean Bowe). Full license texts are in the About Copia window (right-click the menu bar icon).