Salaries, reviews, grievances, medical notes and exit agreements — usually stored in the same suite everyone else uses, protected by folder permissions.
“Personnel data readable only by the people who must read it.”
For people teams, hr managers and founders handling employment records and sensitive internal cases.
Keys sealed per participant, so an HR case is cryptographically closed to everyone else.
When someone leaves a case or the company, removal rotates remaining keys and is recorded.
Send an offer or an agreement with a passphrase, an expiry within 24 hours maximum and revocation.
Investigation notes stay out of a chat product whose history the vendor can read.
An append-only trail showing exactly who accessed a personnel file and when.
Deliberate deletion with a 30-day trash, so records do not persist past their purpose.
In a conventional suite, IT administrators can typically reach HR folders, and permission mistakes are common because HR structures change constantly. Cryptographic scoping means an administrator without a key envelope cannot read a personnel file, whatever the permissions say.
A grievance or misconduct case fails the moment participants suspect it can be read by colleagues. Encrypted case spaces with explicit membership and an access trail are what makes a promise of confidentiality credible to the people involved.
Employment records are personal data with strict expectations around access, minimisation and retention. Per-person keys support access control, the audit trail supports accountability, and deliberate deletion supports retention limits — while your own policies and records remain your responsibility.
Not unless they hold a key envelope for that space. Administration of accounts and billing is separate from the ability to decrypt content.
Yes, through a protected link with a passphrase and an expiry, without the candidate creating an account.
No. Files are encrypted on your device with XChaCha20-Poly1305 before the upload starts, using keys derived locally with Argon2id. Our servers hold ciphertext only, so there is no preview, no scanning and no staff view of your transfer.
No. They open the link in any browser, type the passphrase you shared separately, and the file is decrypted locally on their machine. Nothing to install, nothing to sign up for.
Public share links always expire within 24 hours at most, and you can make them shorter, limit the number of views, or revoke them instantly. Expiry is enforced by the system, not by a reminder.
Uploads are chunked, resumable and verified after upload, so multi-gigabyte transfers survive a dropped connection, a closed laptop or a hotel network. You resume instead of starting again.
Yes. The free plan includes 1 GB with exactly the same zero-knowledge architecture as paid plans, so you can test a real client hand-off before paying anything.
Because we cannot read your data, we cannot reset it for you. Each account creates a Recovery Kit — a printable PDF with a QR code — to store offline. That is the same property that keeps anyone else, including us, out of your account.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
