Multi-Vault Device Isolation
How the client isolates 1 Personal Vault and up to 4 Enterprise Workspace Vaults with separate keys and databases.
Physical and Cryptographic Separation
The Madar client supports up to five concurrent vaults on a single device: one permanent Personal Vault (personal-default) and up to four Workspace Vaults. Each vault is assigned its own SQLite database file (madar_vault_<vaultId>.db) and a dedicated 256-bit AES-GCM master key stored in hardware-backed storage (Android Keystore / iOS Keychain).
Key-value metadata is strictly prefixed with vault:<vaultId>:*, preventing any cross-vault read or write operation. Each workspace enrollment also generates a dedicated Ed25519 device keypair used solely for that workspace.
- Zero Demo Seeding: The workspace switcher and enterprise UI remain completely hidden until the user scans a valid institutional QR code.
- Protected Personal Vault: Calling executeSelectiveWipe on personal-default throws a hard StateError at the storage layer.
- Per-Vault Offline Outbox & Search: Queued offline actions and Arabic normalized full-text search indexes are stored inside each vault's encrypted database.