What Bunker believes

Bunker rests on seven principles, and when two of them pull in different directions, the one higher on this list wins. They’re why the app works the way it does, and they’re how we decide what not to build.

1. Your data is safe even if we’re compromised

Nothing in Bunker depends on trusting us. Not our servers, not an analytics company, not Apple. Your vaults are encrypted on your device with keys that only your Pattern, your Passphrase or your Recovery Phrase can unlock. We have no copy of them. If someone broke into everything we run, they would find nothing of yours, because we don’t hold anything of yours. The details are on the security page.

2. Never lose your data

The most common way people lose private photos isn’t an attacker. It’s a new phone, a forgotten code, or a backup that quietly didn’t happen. So every step in Bunker that could destroy data has a way back, a confirmation, or both. Every vault has a Recovery Phrase. Encrypted Backup is free for everyone and on by default. Moving to a new iPhone has its own checklist.

3. Deniable by default

Bunker never tells anyone whether a Pattern is “wrong”. A Pattern that opens nothing takes the same time, makes the same movement and gives the same feel as one that opens a vault, and then it simply says “No vault opened”, the same words for a mistyped Pattern and a new one. There is no list of vaults anywhere. What you keep, and how much of it, is yours to reveal or not.

4. Calm, not scary

Security should feel like a quiet room, not an alarm. We don’t use fear to sell, and we don’t borrow big words from the army or the bank. We’d rather show you clearly what happens to your files and let you decide.

5. Native first

Bunker is built for iPhone, iPad and Mac with Apple’s own tools and conventions, so it behaves the way your devices already do. We draw our own interface only where the job needs it: the Pattern dial, setting up a Legacy Vault, and choosing a plan.

6. Honest limits

No app can protect you from everything, and an app that claims to is either mistaken or selling something. Bunker can’t protect a phone that’s been compromised, a Pattern someone watched you draw, or a Recovery Phrase someone found in a drawer. A Duress Vault clears your other vaults from this device only; your iCloud backup still holds them. In this first version, enough of your trusted contacts together can open a Legacy Vault at any time. We say these things plainly, in the app and on every page, because you can only trust what you understand.

7. A boring stack

Every dependency is something to maintain and something that can go wrong. Bunker uses Apple’s frameworks, one well-known cryptography library, and no server of its own for your data. Fewer moving parts mean fewer surprises, for you and for us.

What follows from this

No account to create. No ads. No tracking across apps. No copy of your keys. A free tier that’s genuinely useful, because trust takes time. And a plan for the people you love, built in rather than bolted on.

Read who builds Bunker, or see how it works on the security page.