Choosing a private collaboration tool: a 12-question checklist

Use the answers, not the adjectives Every product says "encrypted". These twelve questions produce answers that cannot be faked with marketing copy. Ask them of every candidate, including us.

Architecture 1. What exactly does the server hold when a message is sent — ciphertext, or plaintext it promises not to read? 2. Where are the keys generated, and does any key ever exist on the server in usable form? 3. Can an administrator open a private channel or a private folder? If yes, so can a breach. 4. What happens cryptographically when a member is removed?

Data handling 5. Are file names, folder structure and search terms protected, or only file contents? 6. How does search work? If the server indexes words, it reads them. 7. Is content ever scanned or classified — for moderation, previews or model training? 8. Where is the data stored, under which jurisdiction, and what happens if a provider fails?

Operations 9. How are external recipients handled, and do links expire by default? 10. What is logged, and does the log expose content? 11. What are the backups: are they encrypted, versioned, off-site and immutable for a retention window? 12. What happens when a user loses their password — and if the vendor can restore access, what does that imply about their access?

Reading the answers A genuine zero-knowledge product will give uncomfortable answers to question 12: it cannot restore your data, only your offline recovery material can. A product that offers convenient admin recovery is telling you it holds a key. Both models are legitimate — but only one survives a breach, a subpoena or a curious insider.

The soft criteria that decide adoption Speed, offline behaviour, mobile quality and import paths from existing tools. A tool the team routes around is a tool that protects nothing, so weigh usability as a security property rather than a nice-to-have.