How to choose a zero-knowledge collaboration platform

Step 1 — Ask the five questions 1. **Can an administrator read a private channel or drive?** Any answer other than a plain no means keys are held somewhere central. 2. **What exactly does the server store when a message or file is created?** You want "ciphertext plus sealed key envelopes plus operational metadata", and you want the metadata enumerated. 3. **What happens cryptographically when a member is removed?** Rotation of remaining envelopes, or it is not really removal. 4. **Are names and structure encrypted, or only contents?** Folder trees and file names leak strategy. 5. **How does search work?** Blind indexes computed on the device are private and usable; server-side indexes mean the server sees your content or your terms.

Step 2 — Accept the trade-offs explicitly Write them into your evaluation document so nobody is surprised later: - No provider-side content search or previews. - No integrations that read your data. - No administrator password reset; recovery depends on an offline kit. - Compliance regimes requiring provider-held readable archives are incompatible.

Step 3 — Check the operational surface Hosted or self-hosted? If self-hosted, who patches it at 2am? If hosted, what does the provider publish about subprocessors, storage regions, backups and incident history? Zero-knowledge does not exempt a vendor from operational transparency.

Step 4 — Verify the human factors - Sign-in with passkeys, reviewable sessions, revocable device trust. - Onboarding a non-technical colleague without a key ceremony. - External sharing to someone without an account. - Mobile and offline behaviour, because that is where adoption dies.

Step 5 — Interrogate the compliance claims Ask which certifications are held **today** and request the report or certificate. A vendor that answers with a roadmap and publishes what it does not hold is giving you better information than one answering with a logo. Treat "compliance ready" as a marketing phrase with no defined meaning.

Step 6 — Run a pilot that predicts reality Two weeks, one real project, at least one external collaborator, one very large file, one mobile search, one offline session and one offboarding. Then read the audit trail and check it says what you expected. Note every moment someone reached for the old tool: those moments, not the feature matrix, are your future security posture.

Step 7 — Plan recovery before rollout Decide where Recovery Kits live, who verifies them, and how often. This is the only irreversible failure mode in a zero-knowledge deployment, and it is entirely preventable with a fifteen-minute policy.