RIFT
Windows-first encrypted security
Rift protects sensitive files with layered encryption, network isolation, hardened viewers, virtual-disk security, passkeys, and defensive server controls.
Five levels. One security DNA.
One-time edition pricing with secure Lemon Squeezy checkout.
$15
A focused encrypted vault for local files and deliberate network isolation.
Security level: Core / 3
64-bit Windows 10/11 · Administrator access required for isolation controls.
$25
Full-volume and per-file protection with secure, offline document viewing.
Security level: Layered / 4
Requires Windows Pro, Enterprise, or Education with VHDX/Hyper-V and BitLocker PowerShell modules. Windows Home is not supported for Plus volumes.
$200
The full personal vault with hierarchical crypto, passkeys, sandboxing, and an optional motherboard-backed Device Lock.
Security level: High assurance
Device Lock included: enabled by default, stores only a SHA-256 hardware fingerprint, and can be disabled in Settings before a motherboard change. 64-bit Windows 10/11 · Pro or higher recommended for BitLocker, VHDX, and Windows Sandbox features.
$250
Defensive server security for self-managed Windows infrastructure and operations.
Security level: Enterprise hardened
For authorized Windows server administration. Some controls require Windows Server roles, administrator rights, and separately installed WireGuard.
$300
Both separate Pro applications: Personal for protected workstations and Industrial for self-run server environments.
Includes separate Personal and Industrial installers; each retains its own Windows requirements.
Security levels describe the intended depth of controls, not a third-party certification or guarantee against compromise. Windows feature availability varies by edition and configuration.
Built to reduce exposure
Rift avoids security theater. Each layer addresses a different failure mode, and every edition states where its protection ends.
Vault, folder, and file controls are designed to reduce shared-key blast radius. Pro editions use per-object salts, identifiers, and cryptographic profiles.
Selected adapters and firewall state are captured, changed, verified, and restored. Decryption is designed to stop when requested isolation fails.
Rift Pro Personal can bind startup to a privacy-preserving SHA-256 fingerprint derived from the motherboard serial and system UUID. A mismatch blocks access before the vault opens, and the owner can disable binding from Settings on the authorized PC.
Supported formats remain in local hardened viewers. Unknown content is refused or routed to Windows Sandbox with networking disabled by default.
Pro editions add WebAuthn passkeys, expiring challenges, protected settings, recovery documentation, and explicit security-state feedback.
Watchdogs, exact state restoration, bounded temporary storage, reparse-point defenses, and fail-closed paths reduce residual exposure.
Rift does not promise “unhackable,” “untraceable,” or forensic invisibility. A fully compromised administrator account or kernel remains outside an app-only trust boundary.
Edition matrix
| Capability | Basic $15 | Plus $25 | Pro Personal $200 | Industrial $250 | Suite $300 |
|---|---|---|---|---|---|
| Encrypted local vault | Yes | Yes | Yes | Yes | Both apps |
| Individual file encryption | Yes | Yes | Independent keys | Independent keys | Both apps |
| Encrypted VHDX + BitLocker | — | Yes | Yes | Yes | Both apps |
| Encrypted folder hierarchy | — | — | Yes | Yes | Both apps |
| Passkey / WebAuthn | — | — | Yes | Yes | Both apps |
| Optional motherboard-backed Device Lock | — | — | Included | — | Personal app |
| Network isolation modes | Yes | Yes | Yes | Yes | Both apps |
| Built-in PDF + HTML viewing | — | Yes | Yes | Yes | Both apps |
| Photo, video, DOCX, text/code viewing | — | — | Yes | Yes | Both apps |
| Windows Sandbox fallback | — | — | Yes | Yes | Both apps |
| Protected settings tab | — | — | Yes | Yes | Both apps |
| Tamper-evident local audit | — | — | Yes | Yes | Both apps |
| Server posture checks | — | — | — | Yes | Industrial app |
| WireGuard management | — | — | — | Yes | Industrial app |
| Reviewable hardening output | — | — | — | Yes | Industrial app |
| Intended security depth | Core | Layered | High assurance | Enterprise hardened | Complete |
Compatibility first
Review these requirements before purchase. Rift uses privileged Windows security features that are not available on every edition or device.
Feature availability depends on the installed Windows edition, enabled optional features, organization policy, hardware virtualization, and administrator permissions. Contact support before purchasing when compatibility is uncertain.
The hard line
Rift minimizes data exposure without adding evidence destruction, security-tool bypass, stealth persistence, or false anonymity claims.
Core vault operations are designed to stay on the Windows device. The storefront itself ships without analytics or advertising trackers.
Industrial generates reviewable security actions rather than silently changing server policy behind an administrator’s back.
No application can guarantee safety against all malware, compromised firmware, hostile administrators, physical attacks, or implementation defects.
Before checkout
Every purchase button opens a product agreement step before Lemon Squeezy checkout. Buyers must acknowledge the software license, security limitations, system requirements, and digital-product policy.
Purchases are licensed under That1Dev’s finalized Terms, Software License Agreement, Privacy Policy, and no-voluntary-refunds policy. Review all documents before checkout.
Straight answers
Yes. The listed prices are one-time license prices unless a Lemon Squeezy product page explicitly states otherwise.
Core vault and viewer functions are designed for local operation. Features such as initial purchase, updates, VPN connectivity, or external services may require a network connection.
No. Rift is designed to reduce attack surface and data exposure. No responsible security product should promise perfect protection.
See the Requirements section before purchase. Rift Plus volume creation requires Windows Pro, Enterprise, or Education with the VHD/Hyper-V and BitLocker PowerShell modules; Windows Home is not supported for that mode.
It is enabled by default and stores only a SHA-256 fingerprint derived from local motherboard/system identifiers. If the fingerprint changes, Pro Personal blocks startup before vault access. The owner can disable or re-enable it in Settings while using the currently authorized PC. Disable it before replacing a motherboard.
No analytics, ad pixels, or third-party fonts are included. Lemon.js loads only after a buyer accepts the agreement and continues to checkout; Lemon Squeezy then applies its own privacy practices.
Rift editions designed for fail-closed operation refuse to expose plaintext when requested network isolation cannot be verified, then attempt to restore captured system settings.
Lemon Squeezy securely provides the installer attached to the purchased product after payment. You can also access current product files later from the receipt email or Lemon Squeezy My Orders.
Pick the boundary
Start with a hardened local vault or deploy the complete Pro stack across personal and self-managed server environments.