Grovia Vault is built on the principle that security cannot be bolted on after the fact. Every layer — from key derivation to storage — is designed to resist compromise, even if the Grovia servers themselves are breached.
Every file change is scored by five independent detection layers. A composite threat score from 0–100 determines the response — from safe backup to immediate block and alert.
Measures the randomness of a file's byte distribution using Claude Shannon's information entropy formula. Normal documents (PDFs, Word files, source code) typically score 3–6 bits/byte. Ransomware-encrypted content scores 7.5–8.0 — near maximum entropy — because good encryption makes output indistinguishable from random noise. Any file above 7.5 bits/byte earns maximum entropy points.
H = -Σ p(x) log₂ p(x) · threshold: 7.5 bits/byteEvery file format has a unique "magic byte" signature at the start of the file (e.g., PDF files start with %PDF-, ZIP files start with PK). Ransomware often renames encrypted files with innocent extensions (.pdf, .docx) while the actual content is encrypted binary. Vault reads the first 8–16 bytes of every changed file and flags mismatches between the real content type and the declared extension.
A curated blocklist of 18 known ransomware file extensions maintained by Grovia's threat intelligence team. Any file renamed to a blocked extension triggers an immediate high-score flag regardless of other layers. The list is updated with each agent release.
Every ransomware strain leaves instructions for the victim — a text file with payment instructions. Vault watches for file creation events matching a regex of known ransom note filename patterns. A match here is the strongest single indicator of an active ransomware attack and scores maximum points, triggering an immediate block-and-alert response.
This layer catches novel ransomware that doesn't match any known signature. Ransomware encrypts files at machine speed — hundreds or thousands of files per minute. Grovia Vault tracks each endpoint's file-change rate using a rolling 7-day average baseline. When the observed velocity exceeds 10× the baseline, the engine adds velocity points proportional to how far above the threshold the rate is. This is the most robust detection method because it requires no prior knowledge of the specific ransomware strain — behavior-based detection always catches new variants.
rolling 7-day baseline · EMA smoothing · 10× multiplier thresholdThe composite score from all five layers determines the automated response.
Live threat score meter — animated on page load
Beyond ransomware detection, every component of the Grovia Vault platform is hardened against attack.
Military-grade authenticated encryption. Every chunk encrypted client-side. GCM mode verifies integrity on decryption — any tampering is caught.
HS256 JSON Web Tokens with 24-hour expiry for API auth. TOTP-based multi-factor authentication enforced on all account access.
PostgreSQL RLS policies enforce tenant isolation at the database layer. No query can access another tenant's data — not even an application bug.
Agents upload via short-lived presigned PUT URLs (15-min expiry). Storage credentials never exist on agent devices — eliminating credential theft as an attack vector.
Compliant with India's Digital Personal Data Protection Act 2023. Data residency options in Mumbai (ap-south-1). Audit logs available for regulator requests.
Server-side session store in Redis enables instant session revocation. Log out all devices, revoke compromised tokens, or enforce MFA re-enrollment centrally.
B2 and S3 Object Lock (WORM mode) prevents backup deletion or modification for the configured retention period — even by a compromised admin account.
Tamper-evident log of every backup run, restore action, policy change, and login event. Immutable audit records satisfy RBI, SEBI, and DPDP compliance requirements.
Zero-knowledge means exactly what it says: even if Grovia's servers are compromised, your data remains encrypted and unreadable. Here's how the key derivation works.
This all happens locally on your device, before any network call is made.
Free plan includes full AES-256-GCM encryption and the complete 5-layer ransomware detection engine. No credit card required.