Before you choose Lock
Questions worth asking.
Privacy comes with practical trade-offs. Here is what to expect, including the limits of recovery and what is not enforced yet.
Can I recover my account if I forget my password?
Use the email password-reset flow to regain account access. Recovering encrypted history is a separate step: you need an existing unlocked device, the password that protects your encryption-key backup, or a previously configured encryption recovery key. A reset link cannot recreate a lost private key.
What happens if a device is lost or stolen?
Use your device provider’s remote lock or wipe tools, secure your email account, and change your Lock password from a trusted device. Do not assume a password change remotely erases cached messages, encryption keys, or all existing sessions. A new device can recover history only if you can unlock the same encryption key. Someone with access to an unlocked device may read locally available messages.
Who can administer my team?
Authorized owners and administrators can manage invitations and membership. Removing a member prevents future authenticated access to that team; it cannot retract messages or files they already downloaded, nor erase keys from their devices. Team administration is not an administrator decryption or recovery service.
How long are messages and files retained?
The advertised Basic plan lists 30 days of history and Pro lists unlimited history. Automated plan-based retention and deletion are not currently enforced; a history window is not a guaranteed deletion policy. Unsent encrypted uploads expire after 60 minutes and are removed by scheduled cleanup. Confirm an enforced policy before relying on Lock for a mandatory retention or deletion requirement.
Which platforms are supported?
Lock has a web client and native iPhone and macOS apps. There are no native Android or Windows apps today; those users can use a compatible browser. New encrypted attachments share the same format across web, iPhone and Mac. App distribution and browser microphone support are separate from encryption support.
How does encryption change recovery?
Encrypted messages and files require the original decryption keys. If every usable key and recovery method is lost, account access alone cannot restore the content. Keep your configured encryption recovery key somewhere safe; two-factor authentication recovery codes are not encryption recovery keys. Password-protected backups also have an important authentication-server trust limitation. Read the recovery and trust details.
Want the technical evidence? Read the security details and attachment test vector.