Gun Vault

Terms of Service

Last updated: October 29, 2026

Gun Vault is provided by Southland Labs as invite-only experimental software for private firearm recordkeeping. By creating an account, accepting an invitation, signing in, uploading records, or using any feature of this service, you agree to these Terms of Service and the accompanying Privacy Policy in their entirety. If you do not agree with any part of these Terms, you must not use the service.

Purpose

Gun Vault is designed solely to help invited users maintain private, organized records of their personal firearm inventory. The service stores user-provided firearm inventory, owner profile, photo, document, export, and account recovery information. Sensitive vault fields are encrypted at rest and returned through authenticated account requests.

Gun Vault is not legal advice, compliance advice, transfer approval, insurance advice, appraisal advice, law-enforcement reporting, tax advice, or a substitute for any record required by federal, state, local, or tribal law. Nothing stored in or generated by Gun Vault should be interpreted as meeting any specific legal, regulatory, evidentiary, insurance, or compliance requirement. Users are solely responsible for understanding and satisfying all applicable laws in their jurisdiction.

Invite-Only Access

Access to Gun Vault requires a valid, unexpired invitation code issued by Southland Labs. Invitations are non-transferable, may expire at any time, and may be revoked or limited at the sole discretion of Southland Labs. The service is currently in an experimental phase and is not available to the general public.

Southland Labs reserves the right to suspend, restrict, or permanently remove access to any account at any time, with or without prior notice, for reasons including but not limited to: abuse of the platform, attempted bypass of security controls or invitation requirements, unlawful use or storage of content, security risks posed to the service or other users, excessive support burden, or any material violation of these Terms.

Your Data and the Encryption Model

Your vault data belongs to you. Sensitive vault content—including firearm records, serial numbers, owner identification information, photos, uploaded documents, and notes—is encrypted at rest using AES-256-GCM with an account-specific vault key.

The current architecture wraps account vault keys with server-side secret material and decrypts records in the Worker when serving authenticated requests. It is not a zero-knowledge or end-to-end encrypted architecture. An operator or attacker with access to both production secrets and encrypted database content could technically decrypt vault data.

Routine support and administration tools do not expose vault contents. Access to production secrets is restricted, and sensitive account and administrative operations are authenticated, rate-limited where appropriate, and audited.

AES-256-GCM Encryption

Sensitive vault data is protected at rest using AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode), a symmetric authenticated-encryption algorithm. Each account is assigned a unique vault key, which is stored in wrapped form using server-side secret material maintained through Cloudflare secrets infrastructure.

The following categories of data are encrypted at rest using this method: firearm records and details, serial numbers, firearm categories and calibers, possession status and dates, notes and modifications, owner identification numbers, uploaded photos, and documents. Account names, email addresses, session records, rate-limit counters, and audit logs are operational metadata handled separately under the Privacy Policy.

Users may download the raw vault key for the current key version. It is an advanced-recovery artifact, not a complete backup, and the service does not currently provide an in-app key-restore workflow. It must be stored securely.

Your Responsibilities

You are solely responsible for everything you store in, do with, and export from your Gun Vault account. This includes, without limitation:

Data accuracy: You are responsible for the accuracy, completeness, and currency of all records you enter. Gun Vault does not verify, validate, cross-check, or independently confirm any information you provide. Inaccurate records are your responsibility alone.

Legal compliance: You are responsible for ensuring that your possession, transfer, storage, and use of every firearm in your records complies with all applicable federal, state, local, and tribal laws. Gun Vault does not provide legal guidance of any kind. It is your responsibility to understand the laws that apply to you.

Safe storage: You are responsible for the physical safe storage of all firearms you record. Gun Vault is a digital recordkeeping tool and has no bearing on your real-world storage obligations or practices.

Lawful content: All content you upload — including photos, documents, and text — must be lawful. You must not use Gun Vault to store, transmit, or maintain any content that is illegal, fraudulent, or in violation of any applicable law or regulation.

Prohibited conduct: You must not use Gun Vault to facilitate illegal conduct of any kind; impersonate another person or entity; store content related to unlawfully modified or prohibited weapons; attempt to access, view, or interfere with another user's vault or account; test, probe, or attack the service's security or infrastructure; share your account credentials with another person; or attempt to circumvent invitation requirements, rate limits, or access controls.

Credentials, Encryption Keys, and Account Security

The security of your account depends on both service controls and your own actions. You are responsible for:

Your password: Choose a strong, unique password. Do not reuse passwords from other services. If your password is compromised, your account may be accessible to an unauthorized party until you change it.

Your email account: Password reset and account recovery workflows rely on your registered email address. If your email account is compromised, your Gun Vault account may also be at risk. Secure your email account with a strong password and two-factor authentication.

Your authenticator app: If you have enabled two-factor authentication (which is strongly recommended), your authenticator app is a critical piece of your account security. Losing access to your authenticator without completing recovery steps in advance may result in permanent loss of account access.

Your remembered devices: Non-administrator accounts may use a time-limited remembered-device cookie. The recorded browser identifier must also match, but the token is not cryptographically bound to specific hardware or a network, so protect it like a credential and revoke it if the device is lost or compromised.

Downloaded exports and key backups: Any file you download from Gun Vault — including spreadsheets, PDFs, database exports, and vault key backups — is your responsibility from the moment you download it. Southland Labs has no ability to control, recall, or protect files once they leave the service. Store downloaded files securely and delete them when no longer needed.

Your vault key backup: If you download a vault key backup, that file contains cryptographic key material for the current key version. Treat it as one of your most sensitive documents. Backups made before a key rotation do not open data encrypted with the new key.

Normal support tools cannot display vault contents. Do not rely solely on Gun Vault for recordkeeping; maintain your own secure backups.

Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is strongly recommended for all non-administrator accounts and is mandatory for all administrator accounts. 2FA significantly reduces the risk of unauthorized account access in the event that your password is compromised.

If you choose not to enable 2FA on a non-administrator account, you expressly acknowledge that the risk of unauthorized account access is substantially higher, and you accept full responsibility for any consequences arising from that choice, including but not limited to unauthorized access to your account, loss of vault data, or exposure of exported files.

Administrator accounts are required to have 2FA enabled at all times. If an account is promoted to administrator status while 2FA is not enabled, login to that account will be blocked until the user completes the 2FA setup process via the link sent to the registered email address. That setup link expires after 7 days. If it expires before 2FA is configured, the administrator role must be re-granted to trigger a new setup link.

Southland Labs strongly recommends using an authenticator app (such as a TOTP-based app) rather than SMS-based 2FA where supported, as authenticator apps are more resistant to SIM-swapping and social engineering attacks.

Support

Sensitive support actions require your explicit authorization through a support PIN or emailed code. Routine support tools do not display your firearm records, uploaded files, or owner identification fields.

Support can assist with available account recovery workflows but cannot guarantee recovery in every situation.

Support actions that affect your account — such as password resets, authenticator resets, and certain administrative changes — are rate-limited to prevent abuse. Some administrative support actions may require a verification code sent to your registered email address. Authenticated support tickets are limited per account per month to prevent abuse of the support system.

Support is provided on a best-effort basis. Southland Labs makes no guarantee of response time, resolution, or outcome for any support request.

Exports and Local Copies

Gun Vault allows you to export your vault data in multiple formats, including spreadsheets, PDFs, database files, and vault key backups. Exports are generated on demand from your current vault data at the time of the request. These files are not permanently stored or retained by the service as downloadable artifacts after generation.

Once you download an exported file, you are entirely responsible for its security, storage, backup, and eventual deletion. Exported files may contain sensitive firearm information, personal identification data, or cryptographic key material. Handle them accordingly. Do not store them in unprotected locations, share them with unauthorized parties, or leave them accessible on unsecured devices.

Southland Labs cannot revoke, recall, encrypt, or otherwise protect any file after it has been downloaded by you.

Secure Erase and Account Deletion

Gun Vault provides a secure erase feature that removes your vault and account data from the active application database. Secure erase requires identity verification (password and authenticator if applicable), after which a 24-hour waiting period begins. During this waiting period, your account login is blocked, and a cancellation link is sent to your registered email address. If you do not cancel in time, the application deletes the account's records, authentication material, account-linked support data, and active vault key and disables the account. Standalone support or termination-appeal tickets that were submitted without an authenticated account remain subject to the separate 30-day support-ticket retention period.

Trash records — items you have moved to the trash but not yet deleted — may be recovered until deletion is triggered or the automatic 7-day retention period expires. They are then removed from the active application database.

Deleted data may remain temporarily in Cloudflare-managed backup, disaster-recovery, logging, or database time-travel systems until those systems' retention periods expire. Such copies are not available through Gun Vault's normal application or support interfaces. Accordingly, “secure erase” does not promise immediate physical erasure from every provider-held backup.

Audit Logs and Abuse Prevention

Gun Vault employs multiple layers of abuse prevention and security monitoring to protect the service and its users. These include Cloudflare Turnstile for bot detection, IP-based rate limiting for login, reset, and support workflows, session cookies, remembered-device cookies, and internal audit logging.

Administrator panel actions are logged and retained for up to 90 days. These logs record the administrator's email address, IP address, the action taken, and a timestamp. Logs are automatically deleted after 90 days. These logs exist to provide accountability for administrative actions and to assist in the detection of unauthorized access or abuse. Audit log data is covered separately in the Privacy Policy.

No Warranty

Gun Vault is experimental software, currently in limited invite-only operation. It is provided strictly as-is and as-available, without any warranty of any kind, express or implied. Southland Labs makes reasonable efforts to maintain the security, availability, and reliability of the service, but does not and cannot guarantee: uninterrupted or error-free operation; permanent availability of the service or any feature; successful delivery of any email; successful account or data recovery in every case; that the service will meet any legal, compliance, business, insurance, or evidentiary requirement; or that any record stored in Gun Vault will be accepted as valid for any legal or official purpose.

Use of this service is at your own risk. You are responsible for maintaining independent backups of any records that are important to you.

Limitation of Liability

To the fullest extent permitted by applicable law, Southland Labs, its operators, affiliates, employees, and contractors are not liable for any indirect, incidental, consequential, special, punitive, or exemplary damages of any kind arising from or related to your use of Gun Vault, including but not limited to: loss of data or vault records; loss of account access; inaccurate or incomplete records; legal consequences arising from records stored or not stored in the service; errors in user-entered data; compromised login credentials; lost encryption keys or key backups; exposure of downloaded or exported files; third-party service failures (including Cloudflare, SMTP providers, or others); service outages or interruptions; or any action or inaction taken based on information stored in Gun Vault.

Nothing in these Terms limits liability for gross negligence, willful misconduct, or any other liability that cannot be excluded by law.

Governing Law

These Terms are governed by and construed in accordance with the laws of the State of Texas, without regard to conflict of law principles. Gun Vault is operated from Texas, and any disputes arising from these Terms or use of the service shall be subject to the exclusive jurisdiction of the courts located in Texas.

Changes to These Terms

Southland Labs may update, modify, or replace these Terms at any time as the project evolves, as required by law, or as necessary to reflect changes in the service. This includes changes to security controls, storage limits, invitation rules, support procedures, privacy terms, encryption practices, or any other aspect of the service.

Where feasible, Southland Labs will notify users of material changes. However, it is your responsibility to review these Terms periodically. Continued use of Gun Vault after any changes to these Terms constitutes your acceptance of the revised Terms. If you do not agree to the updated Terms, you must stop using the service.