The Vault security update: protecting every action, end to end

This release strengthens protection across six areas:

• Session-bound request signing. Every action initiated from the mobile app is now cryptographically signed and bound to the session that created it. Because each signature is tied to a specific, active session, intercepted credentials cannot be replayed or reused elsewhere, closing off a common avenue of attack.
• A hardened mobile signer. The signing application itself has been reinforced with device-integrity protections that check the health of the device before sensitive operations, alongside stronger encryption of the data held on it. The result is a signer that is materially harder to compromise, even if the underlying device is targeted.
• Encrypted connections throughout. All communication between the app and our signing infrastructure now runs over mutually authenticated, encrypted channels. Both ends of the connection verify each other before any data moves, so traffic cannot be intercepted or impersonated in transit.
• Adaptive two-factor authentication. Authentication now adapts to context. A sign-in from an unfamiliar location triggers a step-up second-factor challenge and sends an instant email alert, giving account owners immediate visibility of access from somewhere new.
• Stronger password recovery flows. Password recovery has been reworked with additional safeguards, and administrators can now initiate resets where appropriate. This gives institutional teams a controlled, auditable way to restore access without weakening the underlying security model.
• Audit logging with full IP traceability. Every action and every active session now records its originating IP address. For compliance and security teams, that means a complete, reviewable trail of who did what, and from where, across the platform.

Together these changes raise the baseline of protection for every account on The Vault, with no change to how teams work day to day.