# Chanora Secure Storage Audit Report

**Document status:** DV meeting baseline candidate  
**Date:** 2026-05-29

## 1. Scope

This report defines the secure-storage audit expected before public/store release.

## 2. Audit Matrix

| Platform | Expected backend | Current evidence state |
|---|---|---|
| Android | Android secure storage / Keystore-backed protection where implemented | Android Keystore-backed DEK deferred to v1.1 |
| iOS | Keychain | Device audit required |
| macOS | Keychain | Device audit required |
| Windows | Credential Manager | Device audit required |
| Linux | Secret Service with documented fallback behavior | Device audit required |

## 3. Required Checks

| Check | Required result |
|---|---|
| Secret persistence | Server passwords and identity secrets are not stored as unprotected plaintext |
| Fallback disclosure | Any file fallback is disclosed in release/security records |
| Diagnostic interaction | Stored secrets are registered for redaction where they can enter logs/export |
| CI behavior | CI keyring disabling is limited to headless test environments |

## 4. DV Conclusion

Secure-storage audit requirements are defined, but per-platform audit evidence is not complete. Public/store release remains blocked for strong secure-storage claims.