the philosophy
Taking back control.
Modern digital life runs through a handful of enormous companies that treat your photos, documents and messages as raw material — mined, modelled, and monetised. The vault is the deliberate opposite: a private, self-hosted environment built for data sovereignty, not data extraction. No proprietary black boxes. No telemetry heading back to Silicon Valley. Just infrastructure that does exactly what it's told, and nothing else.
taking back the stack
The open-source shift.
Privacy makes the most sense when you can see what you're leaving behind. Here's the swap as a commit — proprietary ecosystems removed, self-hosted equivalents added. Quietly, it doubles as a map for de-Googling your own life.
-Google Photos · iCloud Photos
+Immich // The photo library that never phones home.
-Google Drive · Dropbox · OneDrive
+FileBrowser // Your files, on our servers in the UK.
-the glovebox full of receipts
+LubeLogger // A proper service history for every vehicle you own.
-LastPass · 1Password · Bitwarden
+Vaultwarden // Every password, end-to-end encrypted, on servers we run.
-Google Timeline · Life360
+Dawarich // Everywhere you’ve been, mapped on hardware that isn’t selling it.
-Pocket · Raindrop · Instapaper
+KaraKeep // Everything worth keeping, in one searchable place.
the fortress
Private by construction.
Two UK servers, joined over an encrypted WireGuard mesh. Privacy here isn't a setting you switch on — it's how the whole thing is built.
forward-secret · keys rotate every few minutes
uk infrastructure
Two servers in UK data centres — Coventry and Maidenhead. No oceans crossed, no foreign surveillance jurisdiction. Your data physically lives here.
wireguard encrypted mesh
The two sites talk only across the encrypted WireGuard tunnel shown above, with cryptographic peer identity — no passwords, no exposed login surface, forward-secret keys that rotate every few minutes.
encrypted at rest
TLS 1.3 in transit, AES-256 on the drives, and AES-256 again on the nightly cross-site backups. Encrypted in motion and at rest — no third party holds a key.
open-source core
Every service is open-source and inspectable — no black boxes, no hidden telemetry. Your data stays in standard, portable formats, so you can take it and leave whenever you like.
under the hood
Inside the vault.
A transparent, high-level view of how it's put together — no secrets given away, just proof this is a serious, self-sustaining ecosystem rather than a weekend experiment on a spare board.
$ ./manifest --live
srv01Coventry, UKchecking…
srv02Maidenhead, UKchecking…
meshWireGuard dual-tunnelchecking…
nodes2 × UK servers · Coventry + Maidenhead
meshWireGuard dual-tunnel · encrypted site-to-site
transportTLS 1.3 · ChaCha20
identitysingle sign-on · passkeys
containersDocker · one isolated container per app
backupsAES-256 · nightly cross-site pull
coreopen-source, top to bottom
$
who's behind this
Your data, your rights.
// message from admin gee · root@srv01
Running THE VAULT isn't a hobby — it's a commitment to doing things the right way. Quality over shortcuts, privacy over convenience, ownership over lock-in. Every container, tunnel and backup here is maintained by hand, because your data deserves someone who actually cares where it sleeps at night. That's the whole promise: your data, your rights, kept honestly.
— Gee
appreciate the project
Help keep the drives spinning.
Maintaining an independent, privacy-respecting server environment takes real time, effort and ongoing upkeep. If you share this vision of a decentralised, private web and want to help keep the lights on, your support means the world.
appreciate the project →