Architecture

Phantom systems use layered local security controls.

The architecture is designed to reduce single-point compromise and keep sensitive logic close to the device and user.

Instead of treating passwords or remote services as the only gate, Phantom systems can combine local encryption, trusted hardware, integrity checks, and controlled session handling.

Root trust layer

Keys are derived from local inputs rather than stored directly.

Hardware binding

A trusted USB device can be required before unlocking begins.

Encrypted containers

Vault data remains sealed until the required conditions are met.

Integrity enforcement

Vault structures are verified before access proceeds.

Root Trust Layer

Phantom systems derive vault unlock keys through modern key derivation functions using user-provided secrets and system inputs.

Derived keys are never stored directly.

Hardware Binding

Vaults can require a trusted USB device before unlocking.

  • Device identity
  • Device fingerprint
  • Secret material used during unlock

If the trusted device is not present, vault access cannot proceed.

Encrypted Vault Containers

Sensitive data is stored inside encrypted vault containers that protect credentials, documents, notes, and private records.

Containers remain encrypted until the correct unlock conditions are satisfied.

Runtime

Session isolation

When a vault is opened, Phantom establishes a controlled session environment where decrypted data exists only for the duration of the active session.

Sensitive data is cleared when the session ends.

Verification

Integrity enforcement

Vault manifests and internal structures are verified before vault access begins.

Unexpected modifications are detected before decryption occurs.

Related pages

Architecture only matters if the assumptions are clear

Read the principles and threat model alongside the architecture so the design goals, protections, and limits stay aligned.