Everything you need to know — from creating your vault on the first launch to redacting documents, granting permissions, and running encrypted backups. Takes about 15 minutes to read.
Open Delian Vault for the first time. You'll see the Create Your Vault screen.
correct-horse-battery-staple.Your password is the encryption key. If you forget it and lose your recovery key, your documents cannot be recovered. Not by us, not by anyone. Save both before you continue.
Immediately after creating the vault, a sheet appears with a 24-word recovery phrase. This is the only way to regain access if you forget your password.
Never store your recovery key digitally. Not in Notes, not in a photo, not in a password manager on the same Mac. Paper in a locked place is the correct way — it's the same principle banks use for safe-deposit boxes.
After onboarding, you land on the Dashboard. Click Documents in the sidebar.
You can import in three ways:
Folders are scanned recursively — drop an entire folder of contracts and every file inside gets imported. Duplicates (same name and size) are skipped automatically. Files are encrypted with AES-256 before being written to disk.
Re-importing a file with the same name doesn't create a duplicate — it becomes a new version. More on that in step 9.
Click the funnel icon in the Documents toolbar → New Folder…. Give it a name and click Create. Move documents in by right-clicking a document → Move to folder.
Select one or more documents, open the Actions menu in the bulk bar, and choose Add Tag…. Tags are freeform — use anything meaningful: contract, financials, 2026. Filter by tag from the funnel menu.
Hover any document and click the star to mark it as a favorite. Toggle the star filter from the funnel menu to see only favorites.
Right-click any document → Set Status → choose Draft, Review, Approved, or Signed. The status shows as a colored badge on each row. Use the funnel menu to filter by status.
There are two search modes:
On import, every PDF is scanned for text. If the PDF is a scan of paper, Delian Vault runs OCR on-device using Apple's Vision framework to make it searchable. The results show the matching snippet with context.
Open any PDF, then click the rectangle.slash icon in the left tool rail (or right-click the document in the list and choose Redact).
Press ⌘Z to undo the last box, ⌘⇧Z to redo. The Clear button removes all boxes at once — this is also undoable.
Redaction only works on PDF documents. If you need to redact a different file type, convert it to PDF first.
ABC- or SMITH-).You can place the same signature multiple times on different pages. Just click Sign again, then click where you want it to go.
When you import a file with the same name as an existing document, Delian Vault doesn't overwrite it. Instead, it creates a new version.
Each version is logged in the audit trail with a timestamp and note.
Set an expiry when granting permission — e.g. "view until 30 days from now". After that date, the permission is automatically revoked. Perfect for external counsel or consultants who need temporary access.
Click Audit Log in the sidebar. Every action in the vault is recorded here:
Search by keyword, filter by user, or export the log for compliance reporting. Admins can delete individual entries or clear the entire log — both actions are themselves logged.
Choose Vault → Export Vault Backup… from the menu bar.
.dvbak file.The backup contains everything:
To restore: Vault → Restore from Backup… and enter the backup password.
Export a backup at the end of every working week and store it on an external drive or in an offline location. Update the "last backup" date in your calendar.
If your Mac has a fingerprint sensor, you can unlock the entire vault with Touch ID instead of typing your password.
Touch ID is a convenience layer — the actual encryption is still derived from your password. If your Mac's biometric hardware is reset or you change your enrolled fingerprints, Touch ID will stop working and you'll fall back to password login.
Not in a digital file. Not in a photo. Not in the same Mac's password manager. Paper in a locked drawer or safe-deposit box is the correct method.
Four random words are stronger than eight random characters. correct-horse-battery-staple is easier to remember than X7$mK#2q, and just as secure.
Export a .dvbak file every Friday and store it offline. It's the only thing that protects you from a hardware failure or accidental vault deletion.
Give reviewers View, not Edit. Give editors access to specific folders, not the whole vault. Least privilege is the founding principle of data room design.
When you share a document with external counsel, a buyer, or an auditor, set an expiry. You'll never have to remember to revoke it — the app does it for you.
In Settings → Security, set auto-lock to 5 or 15 minutes. If you step away from your Mac, the vault locks itself.
Even if nothing seems wrong, read the log. Unexpected entries are the earliest sign of a security problem.
Five wrong passwords → vault locks. This is what makes brute-force attacks on your vault impossible. Leave it on.
That's everything. Delian Vault was designed to be simple enough to use daily and secure enough to trust with anything. If you get stuck, the Support page has answers to common questions, and you can always write to us at delianvault@hermeneialabs.co.uk.
Every email is read and answered personally.