The encrypted vault and sharing

The vault is storage where files are encrypted in your browser before they are sent. The server keeps only scrambled data and cannot read your files or recover your passphrase.

Availability

The vault is built, but it is not switched on for everyone. It appears in the member menu only on accounts that can use it. Encrypted Pro and Encrypted Organization are shown as coming soon on the pricing page, so you cannot buy them yet. Anyone who is signed in can open a vault link that someone shared with them.

Important: if you lose your passphrase, your files are gone

Your passphrase makes the key that protects your vault. We never see it and cannot reset it. If you forget it, and you have no recovery key, nobody can open your files, not even the site's staff. This is the price of having no backdoor.

When you create your vault you also get a recovery key, 52 characters long, shown once. Save it somewhere safe and separate. It is the only other way in. Never give it to anyone, including support.

What is encrypted, and what is not

File names, sizes and contents are encrypted. The server can see who owns an item, how large the scrambled file is, and when it was made. Photos are not part of the vault. Large files are limited by your browser's memory, because they are unscrambled in memory when you download.

Because we cannot see what is in the vault, we cannot scan it. We act only on reports.

Sharing

• With a member. Choose a member who has set up their own vault. The file key is sealed to their key. You can set an expiry and take access back whenever you like.
• With a link. Make a link with a password, an expiry and a maximum number of uses. The link looks like /vault/s/…#k=…. The part after the # never leaves your browser. The other person must be logged in, and needs the password. If you lose the link you cannot see it again; make a new one.

You see each share's status, how often it was used, and an access log. Sharing, revoking, changing your passphrase and some other actions ask for a recent two-factor confirmation if you use two-factor.

The first time you share with someone, your browser shows their key fingerprint. Compare it with theirs by another route if you can.

Organization vaults

An organization with the right plan can have a vault. The owner creates it and hands key copies to members. Removing a member takes away their copy and flags the vault for a key change. A removed member keeps anything they already opened or saved.

Reports

If someone shares something abusive with you, use the Report button on the shared item. Moderators see only identifiers and your reason, not names or contents, and can disable a share or delete the scrambled file.