Lock down your vvault account in five minutes
Whoever gets into your vvault account gets every beat in it, released or not. Here is a five-minute checklist to make it harder to get into, and what already protects it.
Your five-minute checklist
Do it once, in this order.
Secure your email first
Your sign-in codes go to your email, so whoever controls your inbox can ask for one. Give that email account a password you use nowhere else and turn on its own two-step sign-in. If you sign in with Google or Apple, do the same for that account: here's how for Google and for Apple.
Add a second step
In Settings, Security & privacy, go to two-factor authentication and add your phone number. From then on, signing in to vvault also asks for a code sent to your phone.
Turn on the PIN code
In the same place, turn on the PIN code. vvault asks for it when you open it on the web. Close the tab when you step away: a tab that's already open doesn't ask again.
Check what's shared
Open your library and look at who can open each beat and pack. Anything that shouldn't be out, set back to private. How to keep unreleased music private goes further.
Know where a code goes
A sign-in code goes in one place: vvault's own sign-in screen, at vvault.app or in the iPhone app. Never in a reply, a DM or a form someone sent you.
What vvault will never ask you for
If someone asks you for one of these, it isn't vvault, whatever name or logo they use.
Your sign-in code
vvault sends it and you type it on the sign-in screen. Anyone who asks you for it, by DM, email or phone, is trying to get into your account.
The code on your phone
The code sent to your phone goes on the same screen, right after the first one. Nobody needs you to read it out to them.
Your PIN
It opens vvault on your own screen. Nobody else ever needs it.
How to spot a fake
Before you type a vvault code, look at the address bar. vvault's sign-in is at vvault.app. A page that looks the same at any other address is a copy.
A sign-in code you didn't ask for means someone typed your email on the sign-in page. Don't pass it on: it expires by itself.
Pressure is the tell. A DM or an email saying your account or a beat will be removed unless you act right now, with a link to do it: close it, open vvault yourself, and check there. The US Federal Trade Commission warns about the same trick: a message that says there's a problem with your account, or that someone tried to log in.
- Type codes only on vvault.app or in the iPhone app
- An unexpected code means someone tried your email
- When in doubt, open vvault yourself instead of the link
What already protects you
You sign in with a one-time code sent to your email, or with Google or Apple. Codes expire, stop working after a few wrong tries, and are rate limited per IP address, so nobody can try them all.
Your beats sit in private storage, every play goes through a signed link that expires, and the database itself checks who may open what. The security page explains each of these, and lists what vvault doesn't have yet.
- Every upload starts private
- Access rules enforced by the database, not just the screen
- Your beats and your account hosted in the European Union
If you think someone got in
Start with your email, since that's where your codes go: change its password and sign out of it on every device.
Then, on vvault, add the second step if it isn't on yet, and set anything sensitive back to private.
And write to contact@vvault.app from the email on your account, saying what you saw. It goes straight to the vvault team.
Questions
Does the PIN replace the second step?
No. The second step protects signing in. The PIN protects a computer where you're already signed in. Use both.
Where is my PIN kept?
Nowhere in a form anyone can read back. It's hashed with scrypt and its own salt, and checked on vvault's server, never in your browser.
Why does vvault send me a code to sign in?
So there's nothing to remember and nothing to reuse from another site. A code works once, expires, and stops working after a few wrong tries.
Has an outside firm checked vvault?
Not yet: no outside penetration test, and no SOC 2 or ISO 27001. The security page lists what vvault has, and what it doesn't have yet.
Read next
How vvault protects your unreleased music
Private by default, sign in without a password, links that expire. And what we haven't done yet.
Read
How to keep unreleased music private
Send links instead of files, choose who can open each beat, and close access when you're done.
Read
Your data and the GDPR
What vvault collects and why, where it's stored, and how to get a copy or have it deleted.
ReadNever wonder who listened again.
Pro or Ultra, monthly or yearly. Cancel anytime.
Photos: George Becker, Hasan Albari, Nathan Thomas, Raul Ling and Brett Sayles on Pexels