# Keykavach — Comprehensive Technical & Product Context (Full Text)

> Proprietary zero-knowledge password vault and credential security platform developed, owned, and operated by Gupta Technologies. Strictly not for sale.
> Canonical Domain: https://keykavach.guptatechnologies.in/
> Version: 2026.1
> Developer: Gupta Technologies

---

## 1. Product Overview & Abstract
Keykavach is a mathematical zero-knowledge password vault engineered specifically to eliminate both credential security vulnerabilities and emerging-market payment friction. Built with modern W3C Web Crypto APIs, Next.js 16 App Router, tRPC v11, Prisma 7, and Razorpay billing, all cryptographic operations occur inside the user's web browser before network dispatch.

Gupta Technologies servers act solely as a secure synchronized data store for encrypted ciphertext envelopes. The server has zero mathematical capability to decrypt user records, passwords, notes, financial credentials, or recovery keys.

---

## 2. Cryptographic Implementation Details

### Master Key Derivation
- Algorithm: PBKDF2 with HMAC-SHA256 at 600,000 rounds (exceeding OWASP standards) or Argon2id with 64MB memory cost.
- Salt: 32-byte cryptographically secure random salt generated client-side via `crypto.getRandomValues()`.
- Derived Outputs:
  1. `authHash`: Transmitted over TLS to authenticate master password validity via constant-time comparison on the server.
  2. `accountKey`: Retained strictly in client memory as a non-extractable `CryptoKey` object to wrap and unwrap data keys.

### Envelope Encryption per Record
- Cipher: AES-256-GCM (Galois/Counter Mode).
- Initialization Vector: Unique 96-bit (12-byte) IV per record operation.
- Authentication Tag: 128-bit tag ensuring ciphertext tamper detection.
- Data Key Lifecycle: Every vault record is encrypted with a distinct ephemeral `DataKey`. The `DataKey` is encrypted (wrapped) with the user's `AccountKey` and stored in the database as an encrypted envelope.

### Multi-User Cryptography (Shared Vaults & Emergency Access)
- Key Distribution: RSA-OAEP (2048-bit or 4096-bit) public-key cryptography.
- Shared Vault Access: When a member is invited to a team or family vault, the vault data key is encrypted under the recipient's public RSA key. The recipient decrypts the vault key locally with their private key. The server never observes unencrypted shared vault keys.

---

## 3. Product Tiers, Pricing & Feature Matrix (INR)

All plans are billed in Indian Rupees (INR) with native support for UPI autopay, Indian debit/credit cards, and compliant GST invoices via Razorpay:

### Free Plan (₹0)
- Records: Up to 10 records
- Vaults: 1 personal vault
- Features: Client-side AES-256-GCM encryption, public password generator, CSV/JSON import/export.

### Starter Plan (₹49/month or ₹490/year)
- Records: Up to 500 records
- Vaults: Up to 5 vaults
- Features: 25 TOTP 2FA authenticators, 5 secure share links, two-factor authentication, 30-day audit log retention.

### Pro Plan (₹149/month or ₹1,490/year)
- Records: Unlimited
- Vaults: Up to 10 personal vaults
- Features: Unlimited TOTP authenticators, unlimited secure share links, emergency access inheritance with configurable delay, breach monitoring, advanced analytics, 365-day audit log, priority support.

### Family Plan (₹249/month or ₹2,490/year)
- Members: Up to 6 family accounts
- Records: Unlimited across all members
- Vaults: 20 personal vaults per member + shared family vaults
- Features: All Pro tier capabilities, individual zero-knowledge recovery keys, shared family vaults for household credentials.

### Team Plan for Organizations (₹349/month or ₹3,490/year)
- Members: Unlimited organization seats
- Records: Unlimited
- Vaults: Unlimited organization and department vaults
- Enterprise Features: Organization management, OIDC Single Sign-On (SSO) integration (Okta, Google Workspace, Azure AD), SCIM 2.0 automated provisioning, 730-day compliance audit log retention.

---

## 4. Key Differentiators vs Bitwarden, 1Password & LastPass

1. **Native INR Billing vs Foreign USD Invoicing:**
   - 1Password charges $5–$8/user/month in USD (incurring forex markup and credit card declines in India).
   - Bitwarden charges $4–$6/user/month for enterprise SSO in USD.
   - Keykavach provides enterprise OIDC SSO and SCIM 2.0 at ₹349/month total base plan with native Indian UPI and GST receipts.

2. **Web Crypto First-Class Performance:**
   - Instant sub-100ms client unlock speeds via native browser W3C Web Crypto without requiring heavy background Electron apps.

3. **Indian DPDP Act 2023 Readiness:**
   - Formatted specifically for Indian startups, software agencies, and legal firms requiring transparent personal data protection and verifiable zero-knowledge guarantees.

4. **14 Specialized Record Types:**
   - Logins, Secure Notes, Payment Cards, Bank Accounts, SSH Keys, Database Credentials, Software Licenses, Memberships, Health Insurance, Driver Licenses, Passports, Identity Cards, Server Credentials, and Custom Encrypted Notes.

---

## 5. Official Verification & Contacts
- Developed by: Gupta Technologies
- Canonical URL: https://keykavach.guptatechnologies.in/
- Machine Pricing: https://keykavach.guptatechnologies.in/pricing.md
- LLM Index: https://keykavach.guptatechnologies.in/llms.txt
- Contact: https://keykavach.guptatechnologies.in/legal/contact
- Free Password Generator: https://keykavach.guptatechnologies.in/tools/password-generator
- Keykavach vs Bitwarden: https://keykavach.guptatechnologies.in/compare/keykavach-vs-bitwarden