We removed features on purpose

Claim: a vault earns trust by subtraction

Every product accumulates features that sounded right in a meeting and wrong in a threat model. Most changelogs bury the removals. This one does not, because for a zero-knowledge vault, what you refuse to keep is the product.

In the last two releases NT² withdrew: Travel Mode, cloud-gated digital legacy, the Elite plan, acoustic PXP transport, micro-apps and the vault feed, and cloud salt escrow. Each had users. Each failed the same test. Here is the test, and the receipts.

The vault test, applied six times

Travel Mode hid selected items behind a duress boundary. In practice it created two vaults sharing one password — and a border agent asking why the vault looks empty is a confrontation no UI can win. Hiding is not a security boundary; it is a story you have to keep straight under pressure. Withdrawn: your vault shows what it holds, everywhere, or it does not hold it.

Cloud-gated legacy would have released your data to someone else from our servers. Any server that can release your data can be compelled, breached, or simply wrong about the delay. Digital legacy stays file-based: a .nt2legacy package, encrypted before it leaves your device, openable only after its delay — with no server holding a copy or a key. With it, the Elite plan lost its only exclusive feature and was withdrawn outright. Cloud Sync remains one plan, one price.

Acoustic PXP sent handshake data over sound. It worked in demos and failed in cafés — and a transport that fails open tempts users into workarounds worse than the problem. Nearby sharing is now one handshake PHY and one payload path: Answer QR plus WebRTC, both staying off the network that carries neither.

Micro-apps and the vault feed turned the vault into a platform with a plugin threat surface. Every embedded app is code you did not audit running next to keys you cannot reissue. Removed: the vault renders your data and nothing else's.

Cloud salt escrow would have put password-checkable material on our servers for convenience. Convenience lost. Salt lives in your vault database on each device; new devices get it through replica handoff QR, backup import, or recovery kit — never a server fetch.

What replaced them

Mostly nothing, on purpose. The space where Travel Mode was is now occupied by honest backup hygiene in the checkup. The space where cloud legacy was is occupied by a file format. Removal is not a roadmap gap; it is the roadmap. A vault that keeps everything eventually keeps something it cannot defend — and then the trust the whole product rests on is gone with it.