Regulated industries
Healthcare, financial services, and defense contractors that need audit-grade encryption and centralized key custody.
SafeVault for Mac · Generally available
Most encryption tools wait for macOS to load. SafeVault doesn't. Your data is locked from the instant you press power — through boot, login, sleep, and every byte that hits your SSD.
Enter your PIN to continue
Pre-boot authentication · SafeVault for Mac
Trusted by security teams at
The gap nobody talks about
FileVault protects your data after macOS boots. But between the moment you press the power button and the moment LoginWindow appears, your disk is briefly readable — even to an attacker with physical access. Auditors know this. Attackers know this.
SafeVault closes that window by asking for your credentials before macOS even starts loading.
How it works
SafeVault activates during boot, before macOS. The unlock screen appears instead of the Apple logo.
Enter your PIN, tap your YubiKey, or use your corporate badge. SafeVault validates against your company's identity provider.
macOS loads onto an already-decrypted disk. FileVault, APFS, and Time Machine continue to work as usual.
Boot-time protection
SafeVault asks for credentials in the boot picker phase — before LoginWindow, before `launchd`, before APFS mounts your user volume. Your data is unreadable from the first instruction the CPU executes.
Runs at the storage layer, so it catches every read and write — including ones the operating system hasn't even mounted yet.
Performance
Encryption runs in-kernel, on the storage fast path. You get the same sequential throughput, the same tail latency, the same Time Machine backup window as an unencrypted drive.
No buffer bounces to user space. No FUSE. No background daemons spinning during your Zoom call.
Internal benchmark · 2 TB NVMe · 1 MiB sequential
Identity
Active Directory, Okta, Azure AD, Ping, Google Workspace — your employees unlock their Mac with the same identity they use for everything else. PIN-only, PIN + smart card, or full passwordless.
Centralized policy: enforce minimum PIN length, lockout after N failed attempts, hardware-bound keys on every supported Mac.
Compliance
One enrollment, one policy, one report. SafeVault ships the evidence your auditor will ask for: key custody logs, unlock history, tamper attempts, and full-disk encryption status for every Mac in your fleet.
Stream events directly into Splunk, Sentinel, or Chronicle. No custom scripts to maintain.
When teams pick SafeVault
Healthcare, financial services, and defense contractors that need audit-grade encryption and centralized key custody.
Remote-first companies whose MacBooks live on kitchen tables, coworking spaces, and airports — not in locked offices.
Contractors, interns, and seasonal staff who join and leave fast. Revoke access remotely without touching the device.
Security teams that need full-disk encryption they can prove is actually on — even when the device is offline.
“We switched from a well-known FDE vendor to SafeVault because their boot-time unlock was the only one that worked cleanly with our YubiKey fleet. Setup took an afternoon. Our auditors were happy within a week.”
FAQ
It complements FileVault. FileVault protects user data after macOS loads; SafeVault protects everything from power-on, including the window before macOS itself boots. They run side-by-side on the same Mac.
An administrator issues a one-time recovery code from the SafeVault console, or the employee authenticates via SSO and resets their PIN at the next login. No need to ship the Mac back to IT.
It uses a kernel-resident storage filter so it can protect the disk from the first instruction onward. For day-to-day policy, telemetry, and management, it pairs with a normal user-space agent.
No. Encryption runs on the storage fast path, not via user-space FUSE. In internal benchmarks on a 2 TB NVMe drive, sequential throughput is within 1–2% of an unencrypted drive.
Jamf Pro, Kandji, Mosyle, Intune for macOS, and Addigy. Available through Apple Business Manager for zero-touch enrollment.
We'll walk you through a live enrollment on your hardware, answer your auditor's questions, and send you a trial license by end of day.