Your code stays unreadable
Anti reverse-engineering shieldWhat ships is not what was written. Whoever opens the tools is recorded, with who and where.
30-day free trial · 1 app · no cardWatch mode by default: no change for your users
Secure and obfuscate any web app.On any platform. In one step.
Vaultedo watches every attempt to copy your app: an anti reverse-engineering shield over your code, anti-clone and anti-scraping gates in front of your data, and a forensic watermark on every screen that names who saw it. Real users never notice a thing.
One app, watch mode, no card. Sign in with Google, Microsoft or your email.
How it works, scenario by scenario.
The visitor's window, the gate in front of your data and your console. Select a scenario; they also play in turn.
·
Your appCustomersOrdersInvoicesReports
Customersloading…
No data: the gate refused this request.
The gatein front of your data
0 allowed0 refused0 alerts
waiting for the first event
Select a scenario above; they also play in turn.
- Watch mode by default. Record, alert, trace. Nothing is blanked and no user is interrupted.
- Enforcement is one switch, after a day of seeing what it would have refused.
- Not paid: protection stops, nothing is deleted and your application keeps working.
Try to take this app.
The four ways people copy a web application, played out live: the window, the gate and your console. Press an attack and watch what you would be told.
0 attacks tried0 got through0 recorded or tracedPress an attack on any card.Protect your app like this
Copies get an empty page
Anti-clone · domain lockYour pages on any other address get the frame and none of the data, and the copy files itself in your console.
Robots and scripts get 403
Anti-bot · anti-scraping gateA watched session is served as always. Anything else asking for your data is refused and named.
Every screenshot names its viewer
Forensic watermarkNo page can stop a screenshot. Every screen carries its viewer, so a leaked picture names who took it.
Deploys in a click or two commands.
Wherever your application runs. Your users notice nothing while it goes in, and your console shows each step for your platform.
Logos are the trademarks of their owners, shown to say where Vaultedo runs; no affiliation or endorsement is implied.
here.now
Netlify
Vercel
Cloudflare Pages
GitHub Pages
Firebase Hosting
Render
Fly.io
Heroku
DigitalOcean
Railway
Docker
Kubernetes
Node
AWS
Azure
Google Cloud
Oracle Cloud
Akamai
Fastly
Any host, any cloud
nginx
Apache
Next.js
Salesforce Experience Cloud
Shopify
Webflow
WordPress
Squarespace
Wix
Framer
Ghost
HubSpot CMS
BigCommerce
Magento
Works with your AI coding tools.
Vaultedo speaks the Model Context Protocol, so the coding agent your team already uses can add it, deploy it and test it for you.
Logos are the trademarks of their owners, shown to say which tools Vaultedo works with; no affiliation or endorsement is implied.
Claude Code
Codex
Cursor
VS Code with Copilot
Gemini CLI
Windsurf
Any MCP client
Everything it sees, in plain words.
Every app with its state and its switches; an x-ray of each with charts you can press; alerts, an audit log, your team, the plan. These are the real screens.
vaultedo.com/app · Customer portal · X-ray
vaultedo.com/app · Apps
vaultedo.com/app · Home
Three demonstrations, with real components.
Each runs here with the real pieces of Vaultedo: the gate's answer, the shipped code and the mark.
Data served to sessions, refused to scripts
A script requesting the customer list is refused. The same address from a real session is served as before.
Shipped code differs from source code
What you wrote
function toast(title, kind, sub) {
var t = document.createElement('div'); t.className = 'toast ' + (kind || '');
t.innerHTML = '<b>' + esc(title) + '</b>' + (sub ? '<span class="sub">' + esc(sub) + '</span>' : '');
$('toasts').appendChild(t);
setTimeout(function () { t.style.opacity = '0'; t.style.transition = 'opacity .3s'; setTimeout(function () { t.remove(); }, 320); }, kind === 'err' ? 6500 : 3800);
}document.getElementById("toasts"),window.t=function(t,e,s){var n=document.createElement("div");n.className="toast "+(e||""),n.innerHTML="<b>"+esc(t)+"</b>"+(s?'<span class="sub">'+esc(s)+"</span>":""),$("toasts").appendChild(n),setTimeout(function(){n.style.opacity="0",n.style.transition="opacity .3s",setTimeout(function(){n.remove()},320)},"err"===e?6500:3800)};A real function of this very console, before and after the build that ships it. Names, comments and structure are gone; the behaviour is not.
A leaked screen identifies its viewer
Decoded from the pixelsdevice 7f3a2c9e · pat@client.exampleseen 09-NOV-2026 02:41 IST · Chrome on Windows · Bengaluru
No web page can stop a screenshot. Every screen your application draws carries its viewer's invisible mark, so a leaked screenshot identifies its viewer.
What it cannot do
Every protection product should state its limits.
- Stop an operating-system screenshot, a recording or a camera
- No web page can. The mark on every screen names the viewer and you are alerted; a camera photo may not keep the mark.
- Forbid a signed-in human reading what their session may read
- It limits the pace and volume, watches the tools they open and records who pulled what.
- Stop a script that imitates a browser perfectly
- It can still ask to be served; too many asks from one place are refused, recorded, and the place is named.
- Hide code from somebody determined, forever
- Obfuscation raises the cost of reading your code; the data and the model stay on your server, behind the gate.
One price per protected app, or one for the company.
Start free for 30 days: one app, watch mode, no card. The trial ends in a choice, never in an unexpected charge.
Per protected app
$500a month, per app
- Watches every attempt: robots, developer tools, copies, prints, screenshots
- Refuses robots and copies at the data gate once enforcement is on
- Obfuscates the code
- The invisible mark on every screen
- Alerts by email, audit log, team, reports
A year
$4,800a year, per app
- Everything above
- 20% less than month by month
- One invoice a year
Company
$2,500a month, every application
- Every application of your company, with no count
- On your verified domains, so the plan stays yours
- $24,000 a year, 20% less
- Everything in the per-app plan
Own cloud
Askinstalled in your cloud
- Everything above, running in your account
- Single sign-on, data residency
- Named support
Payment through Paddle, card or invoice; a 14-day unconditional refund.
Delivered as a sealed, signed release.
Every part of Vaultedo you install is one versioned file or image: checksummed, signed, installed from a link in your console, upgraded by us, and removed by one link.
vaultedo-guardrelease · stable channel
996b251071- Checksum
- sha256 996b251071327e59…
- Signature
- Ed25519 · verified
- Install link
- vaultedo.com/g/996b251071/guard.js
- Licence
- per protected application · not paid: the guard switches off, nothing breaks
SealedSignedInstalledUpgraded by usRemoved by one link
A release is one file identified by its checksum, or one image identified by its digest. Nothing inside it can be edited by the subscriber.
- Nobody edits it.Settings reach the gate signed; there is no rule file to break.
- No upgrade to run.Hosted parts move when we publish; self-hosted parts check hourly and restart.
- Connected, visibly.The first token your page fetches marks the install Connected within a minute.
- Leaving is one link.Uninstall removes it; the console confirms and offers to delete the data.
Protection in place today.
Sign in, register your company, add the application and install one tag. The first attempt to copy it appears in your console with who and where.