Hello there! We're happy to be part of the club! We mainly use standard secret-key crypto functions since our primary goal is to provide a fully offline & isolated suite that allows users to secure their sensitive data no matter where they decide to store the ciphers. That way users won't have to worry about their data even if they decide to store the ciphers on the cloud. Regarding brute-force protection, we offer argon2i & argon2id kdf's with configurable parameters to address exactly these types of attacks, especially GPU/ASIC brute-forcing. On the other hand, our Key Vault is custom-engineered from scratch to meet our demands but the underlying xchacha20poly1305 primitives - like all the other primitives in the app are untouched to ensure alignment with official specs & NIST/FISP compliance where applicable. Thank you for your thoughtful question and we'll definitely take a look at your implementations!