AES-GCM
Authenticated encryption in the browser. Plaintext files are not uploaded.
Architecture
The browser binds it. We keep only what we cannot read.
We hold ciphertext and wrapped keys — not your passphrase. A chest, not a window.
Files are encrypted in the browser with authenticated AES-GCM before upload. Integrity is checked on decrypt. Vault keys are wrapped with a key derived from your passphrase on your device. We never receive the passphrase.
Server-side storage is ciphertext. We cannot open your files. Account email and operational metadata are still ours to hold. That is not “no data even when compelled.” What kind of operational metadata can we see? Here’s an example.
Passphrase-wrapped keys
Your passphrase wraps the vault key locally. Losing it means we cannot recover the vault.
What we still hold
Account email, ciphertext blobs, and operational logs. We say this out loud. What kind of operational metadata can we see? Here’s an example.
Important notes
Report a concern any time — a real person reads it.
Reach the team directly through our security contact form. The web vault runs as an invitation-only Alpha, encrypting everything on your device before it ever reaches us.