Every file is partitioned and encrypted using AES-256 in Galois/Counter Mode. GCM provides both confidentiality and built-in cryptographic authentication, verifying that no ciphertext modification or bit-flipping attack has occurred prior to decryption.
Key derivation employs memory-hard password stretching via Argon2id (or configured high-iteration PBKDF2-HMAC-SHA256) combined with a cryptographically secure random device salt, mitigating rainbow-table and GPU-accelerated dictionary attacks.
Critical cryptographic primitives implement the Rust Zeroize trait. When the user exits the application, locks the screen, or activates the panic lock gesture, sensitive key buffers in memory are actively overwritten with zeroes to minimize cold-boot exposure.