ProShield VaultProShield is a local-first vault for credentials, cards, documents, images, notes, and business records. Sensitive vault content is encrypted by the application before optional backup to a Google Drive account selected by the user.
ProShield has completed an exhaustive internal self-assessment against all 72 applicable security decisions in the OWASP Mobile Application Security Verification Standard (MASVS v2). This verification covers data storage, cryptography, authentication, and network communication. Detailed evidence mappings for all 24 technical requirements have been finalized and are available for review as part of our audit-readiness process.
1. Assurance status
What "verified" means here
ProShield has completed an internal self-assessment against all 72 applicable controls in the OWASP Mobile Application Security Verification Standard (MASVS v2), covering data storage, cryptography, authentication, and network communication. This assessment combined manual engineering review with AI-assisted analysis across multiple models, and produced a detailed evidence matrix mapping each control to how it's addressed in the app.
This is a self-assessment, not an independent audit. It reflects our own review of our own code, using our own methodology. We're publishing it because we believe transparency about internal work is better than no visibility at all — not as a substitute for external verification.
What's next
An independent third-party security review is planned but has not been scheduled. If one is completed, we will publish its scope and findings here. Until then, treat the MASVS assessment as our internal claim, pending outside confirmation.
Evidence matrix
Our public AI Transparency Report summarizes the review method and technical claims. The control-by-control evidence matrix remains an internal working document.
2. Security accountability
ProShield is operated by TechShield Technologies in Ajman, United Arab Emirates. Qusai Maljiwala is the accountable executive for ProShield security. Security reports currently use the reporting channel described below.
3. Security model
Vault encryption
ProShield uses AES-256-GCM authenticated encryption for vault records and encrypted file blobs. A randomly generated data-encryption key encrypts vault content. A key-encryption key derived from the user’s credential protects that data-encryption key.
Password derivation
The application uses Argon2id to derive key material from the master password. The master password is not intended to be uploaded to TechShield as part of normal vault operation.
Local-first operation
Personal vault data is maintained on the user’s device. Optional Google Drive functionality stores encrypted backup data in the account the user connects. Decryption is intended to occur in the ProShield client after the user unlocks the vault.
4. Protection boundaries and limitations
ProShield is intended to protect stored vault content against access without the user’s vault credentials. It cannot guarantee protection when a device, browser, operating system, connected Google account, or unlocked session is compromised.
Content may leave the vault in readable form when a user copies, prints, exports, screenshots, or shares it through another application. The destination and recipient then control that copy. Device malware, malicious browser extensions, screen capture outside supported controls, weak master passwords, and unsafe recovery-material storage remain user and platform risks.
No software is invulnerable. Encryption does not prevent data loss caused by forgotten credentials, unavailable recovery material, damaged devices, deleted backups, or third-party service failure.
5. External services
Google OAuth is used when a user chooses Google sign-in, Drive backup, or supported business-workspace functions. Google controls its account security, service availability, and platform processing. ProShield requests access needed for the selected function; users should review the consent screen and their Google account permissions.
Have I Been Pwned
An optional password-breach check uses the Pwned Passwords k-anonymity protocol. The application sends a short prefix of a password hash rather than the password or complete hash.
Operating systems and app stores
Device storage, browser security, biometric prompts, application signing, and updates depend partly on the operating system, browser, and official distribution platform. Their compromise can weaken application protections.
6. Recovery and backups
ProShield provides recovery material during setup. Anyone who obtains sufficient recovery information may be able to regain access, so it should be kept offline or in another appropriately protected location. Losing both normal credentials and usable recovery material may make the vault permanently inaccessible.
Users should verify that a backup completes and that their recovery material is readable. Deleting the local application or vault does not necessarily remove an existing encrypted Google Drive backup.
7. Report a security issue
Security researchers and users can report a suspected vulnerability to support@proshieldvault.com with the subject “Security Report.” Do not include a master password, recovery code, real identity document, production vault, or other personal secret.
Please read the Vulnerability Disclosure Policy before testing. Publicly known security notices will be listed on the Security Advisories page.
8. Versions and security updates
Users should install ProShield only from official links on this website and keep the application, browser, and operating system current. A formal supported-version lifecycle is being established. Until that policy is published, users should treat the newest generally available release as the supported release.
Material security corrections will be documented in the Security Advisories page when disclosure is safe and appropriate.