Limits, honestly

Immutability is a strong guarantee, and strong guarantees have honest costs. Here they are, plainly.

History uses storage

Every change keeps the old revision, so an entry you edit often grows over time. In practice this is tiny — credentials are small, and even a heavily-rotated entry is a handful of kilobytes of history. But it is not free, and it only ever grows. We think a complete record is worth a few kilobytes. If you don't, this is the trade you're making.

You can't selectively erase the past

There is no "delete just this old password from the history." That's not a missing feature — it's the whole point. The moment the vault can quietly remove one revision, "nothing is ever overwritten" stops being true, and every guarantee built on it weakens. History is all-or-nothing on purpose.

Real erasure is whole-vault

When data genuinely must be destroyed — a legal erasure request, closing an account — the unit of deletion is the entire vault, not an edit to its history. This keeps the immutability promise honest: the vault never rewrites its own past, not even to forget. It's a heavier hammer, used deliberately, rather than a quiet edit that would undermine the record.

Old revisions are encrypted, not extra exposure

Keeping history does not widen your attack surface. Every revision — current or ancient — is encrypted with the same protection as live data. A stolen vault file yields the same useless ciphertext whether it holds one revision or a hundred. History is more record, not more risk.

History is not a backup

Version history protects you against changes — a bad edit, a rotation you need to reverse, a question about what was true last month. It is not disaster recovery. Losing your hardware key is a different problem with a different answer: see Recovery.

---

If any of these trade-offs is a dealbreaker for your situation, we'd rather you know now. Talk to us — the honest conversation is the one worth having.