If a provider can read a privileged document, that capability exists whether or not it is used. Zero-knowledge removes the capability.
“Privilege protected by mathematics, evidenced by an audit trail.”
For litigators, transactional lawyers and in-house teams who need a defensible answer about third-party access to privileged material.
Master keys are derived on the device with Argon2id and never transmitted. There is no server-side key escrow.
Each authorised person receives their own sealed envelope of the matter key, using X25519. Access is a cryptographic fact, not a database flag.
An append-only trail records who was granted access, when, and when it was revoked — useful when handling is questioned.
Links to opposing counsel or experts can expire automatically and be revoked instantly.
No AI classification, no human review queue, no advertising model. There is nothing readable to process.
Storage regions and subprocessors are published, so you can answer client questionnaires accurately.
Privilege discussions focus on mis-sent email, but the wider surface includes vendor administrators, support tooling, backup systems, integrations and third-party processors. Client-side encryption collapses that surface: those systems continue to exist, and they continue to hold nothing readable.
A provider that can decrypt can be asked to decrypt. A provider that cannot can only produce ciphertext and operational metadata. That difference is worth stating explicitly in your engagement letters and vendor assessments.
Passkeys and hardware-backed device trust reduce credential risk, session review lets you revoke a lost laptop, and matter-scoped membership keeps paralegals, contractors and co-counsel restricted to the matters they work on.
Jurisdictions generally focus on whether reasonable steps were taken to preserve confidentiality. A system where the provider cannot decrypt, access is per-matter and every grant is logged is a strong set of reasonable steps — but you should confirm against your own bar guidance.
We can produce only what we hold: ciphertext and operational metadata. We cannot produce plaintext, because we have no key that would yield it.
No. Everything is encrypted on the device before it is uploaded, with XChaCha20-Poly1305, using keys derived locally with Argon2id and wrapped per member with X25519. Our servers hold ciphertext and sealed key envelopes, so there is no admin view, no support tool and no classifier that can reach your content.
No. There is nothing to self-host and no key server to operate. You create an account, invite colleagues and clients by email, and the encryption happens transparently in the browser, desktop and mobile apps.
We do not currently hold SOC 2 or ISO 27001 certification, and we say so publicly rather than implying otherwise. Our compliance page documents where we are, what is in progress, and what is planned. What we can demonstrate today is the architecture itself: client-side encryption, per-member key envelopes and an append-only audit trail.
Removing a member revokes access and rotates the remaining key envelopes, so an old copy of a key stops opening anything new. Every membership change, share creation and revocation is written to an append-only log.
Because we cannot read your data, we cannot reset it for you. Each account creates a Recovery Kit — a printable PDF with a QR code — to be stored offline. That is the same property that stops anyone else, including us, from reading the account.
Yes. The free plan includes 1 GB with exactly the same zero-knowledge architecture as paid plans, so you can validate a real client workflow before committing.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
