Encrypted in transit
All client traffic uses TLS. Uploads and downloads to object storage use signed, time-limited URLs over HTTPS.
Security
We describe the protections we actually ship. Files are encrypted in transit. We do not claim end-to-end encryption unless it is implemented.
All client traffic uses TLS. Uploads and downloads to object storage use signed, time-limited URLs over HTTPS.
Objects live in private buckets. There is no public listing of your files; access is mediated by the application.
Sessions are established through the configured auth provider with HTTP-only cookies on the web app — not ambient LAN identity in production.
We maintain database backup and restore procedures so metadata can be recovered if something goes wrong.
We optimize for private vaults, least-privilege APIs, and clear security boundaries — without overclaiming cryptography we have not shipped.
End-to-end encryption (client-side encryption where only you hold keys) is not marketed here. When that capability ships, this page and the product docs will be updated together.