ProShield Vault1. Executive Summary
ProShield has completed an internal self-assessment against 72 applicable control decisions in the OWASP Mobile Application Security Verification Standard (MASVS v2).
This is our own review of our own code and architecture. No independent product security audit has been published.
2. Methodology: AI-Assisted Review
Multiple AI models helped surface questions for manual engineering review:
- Adversarial Analysis: Code is reviewed by Gemini and Claude to identify edge cases and logic flaws.
- Static checks: AI-assisted analysis compared implementation details with MASVS-STORAGE and MASVS-CRYPTO control descriptions.
- Human review: Engineers evaluated findings before recording conclusions in the internal evidence matrix. AI output alone did not establish a pass.
3. Core Technical Claims
Our internal review identified these implemented protections. They have not been independently audited:
- Local database encryption: ProShield uses SQLCipher to encrypt the local database file at rest.
- Record encryption: Individual vault records use AES-256-GCM authenticated encryption.
- Android biometric protection: On supported devices, Android Keystore authentication protects the vault decryption key.
- Password derivation: ProShield uses Argon2id to derive key material from the master password.
4. Evidence
Technical evidence is maintained in internal working documents. The control-by-control matrix has not been published:
- MASVS internal evidence matrix and review notes.
- Cryptographic specification and platform security baselines.
- Web trust report and dated static-analysis scan results.
5. Independent Review Status
No independent product security audit has been published. An external assessment is planned but has not been scheduled. We will update this page with its scope and findings if one is completed.
Accountable Executive: Qusai Maljiwala, TechShield Technologies