Security
AES-256 encryption, zero-knowledge vaults, two-factor sign-in and audit logs.
Security overview
Security built in, not bolted on
Every layer assumes the next one might fail.
Encryption at rest
Each file is split into 1 MB blocks, each encrypted and authenticated with AES-256-GCM. A modified block refuses to open.
Zero-knowledge mode
Pro lets members encrypt in the browser with PBKDF2 and AES-GCM. The passphrase never leaves the device.
Access control
Two-factor sign-in, brute-force lockouts, per-link passwords, IP allow-lists and role-based access.
Audit trail
Uploads, downloads, shares and sign-ins are logged with time and IP address. Export to CSV in Pro.
You choose the hosting
Files live on your own server in a protected folder, so you decide the country and the compliance regime.
Self-checks
Built-in tools test folder protection and verify encryption integrity on demand.
How a file is protected
- Uploaded over HTTPS, scanned (optional ClamAV) and type-checked
- Encrypted with a random 256-bit key unique to that file
- The key is wrapped by a master key derived from secrets in wp-config.php, not the database
- Stored under a random name in a folder blocked from web access
- Streamed back only after login, permission and rate-limit checks
Honest note: standard mode encrypts files on the server, so the site owner controls the keys. Use zero-knowledge mode when even the server must not be able to read a file.