Why not just a secure link?

Expiry and revocation are table stakes — Proton and Bitwarden both ship them, and Proton says plainly that anyone holding a complete Secure Link URL can reach the content. The two rows that are genuinely different are who can try to open it and there being no secret-bearing link for a preview bot or a mail scanner to fetch.

Built for secrets that should not remain in chat

• IT and operations — API keys, temporary credentials, recovery codes
• Finance — bank details, payment references, account instructions
• Legal and executive teams — client details and private instructions
• Incident response — deliver a temporary secret through the chat channel everyone already has

Two products, two trust models

Neither is a better version of the other. StegoSafe stays fully on-device — that promise doesn’t change. WaxSeal is for the cases where an organization needs to hand a secret to someone and keep authority over it, and accepts that the encrypted content is held in a vault to make that possible.

How WaxSeal works

1. Seal. You encrypt the content and store the ciphertext in a WaxSeal vault under your organization’s control. The photo you share carries only a small sealed reference — not the data itself.
2. Send. The photo travels like any ordinary image: over chat, email, or anywhere else. On its own it reveals nothing and opens nothing.
3. Open. The recipient’s app reads the reference, is protected on the device and unlocked locally with Face ID or Touch ID, and — if policy allows right now — retrieves and decrypts the content on their device.

Because the content sits behind the vault rather than inside the image, the rules travel with it.

What the vault gives you

• Burn after reading — allow one authorised open, then close the seal.
• Limited reads — choose exactly how many authorised opens are allowed.
• Expiry — stop new opens at a deadline, whether or not anyone opened it.
• Recipient binding — a seal that only a designated person’s device can open.
• Instant revocation — stop future opens even after the photo has been sent. The image keeps existing; it just stops opening.
• Audit trail — a record of who opened what, and when.

These controls govern future access. They cannot erase anything a recipient has already read, copied or photographed.

None of this is possible once a secret has fully left your hands. Keeping the content in the vault is what makes recall, expiry, and audit real instead of aspirational.

Run it your way

The vault is the part your organization controls, and you decide where it lives:

• Self-hosted — run the WaxSeal vault on your own infrastructure. The encrypted content never leaves servers you operate, which is the natural fit for teams with strict data-residency or compliance requirements.
• Managed — let us host the vault for you, so there’s nothing to deploy or maintain. You still get the same revocation, expiry, and audit controls.

Either way, the WaxSeal apps come from the App Store like any other app — the choice is only about where your vault runs.

Security

• End-to-end encryption. Content is encrypted on the sender’s device with a fresh AES-256-GCM key, and that key is wrapped (HPKE, P-256) only to the chosen recipients’ device keys. The vault stores ciphertext it cannot open.
• Keys that never leave the device. Each device holds two P-256 keys in its Secure Enclave, protected on the device and unlocked locally with Face ID or Touch ID. Nobody — not the vault, not us — can recover them; a lost device means enrolling a new one.
• Signed, hash-chained authorization. Who belongs to the organisation, with which role, is a snapshot signed by an admin device and chained to the one before. Every device verifies the chain itself; the vault only relays it.
• Invites that prove themselves. Joining needs a single-use invite signed by an admin and bound to the organisation, its vault and the invitee’s role. Admins approve with one tap once the credential verifies — nobody reads numbers aloud.
• A carrier that says nothing. The photo carries an 8-byte watermark token that survives chat-app compression. It reveals nothing on its own, and there are no plaintext markers, consistent with the StegoSafe approach.
• Open format. The wire format is specified, with published test vectors and an independent verifier.

Where your data lives

This is the purchase-deciding question for most teams, so here it is plainly. WaxSeal Cloud stores three things on our servers in Canada: ciphertext (encrypted on your device with a key wrapped only to the recipients’ device keys), the signed authorization objects that say who belongs to your organisation, and the 8-byte tokens that tie a photo to a seal. It never holds plaintext, private keys, or the PIN. Self-Hosted keeps even the ciphertext on machines you operate; the same apps simply point at your server.

Pricing

A member is someone who creates, administers, revokes or audits seals. People who only open what they are sent are recipients: they install the free app and pay nothing.

Get started in ten minutes

1. Subscribe on the WaxSeal pricing page. Stripe handles the card; you get an activation code by email and on the confirmation page.
2. Install WaxSeal from the App Store on the Mac or iPhone that will administer the organisation.
3. Activate the workspace: Settings → Activate a team workspace → your organisation’s name and the code. That device becomes the first admin. (If you already tried the personal demo on that device, it is upgraded in place.)
4. Invite people: Organisation → Create invite → a QR code or a link. They scan it, tap Join and confirm once with Face ID or Touch ID. You approve with one tap; the invite already proved who they are.
5. Send: choose a photo, type the secret, pick recipients, set reads / expiry / PIN. Share the photo anywhere.

Availability

WaxSeal Cloud is available now to organisations that subscribe on this site. The app is free on the App Store for iPhone, iPad and Mac — and anyone can try a private seal on their own device first, with no account. Self-hosted licences are available now; there is no self-service checkout for that tier yet, so we issue the licence and set the team up by hand.

Questions about deployment or compliance: [email protected].

WaxSeal and StegoSafe are products of NEXATECH AI EFFICIENCY SERVICES LTD., British Columbia, Canada.