Internal drives with per-member keys, external links that expire by default, and an access log you can hand to a client or a legal team.
“Every share has an owner, an expiry and a trail.”
For teams sending builds, masters, contracts, designs and datasets to colleagues, clients, partners and freelancers.
The key lives in the URL fragment and never reaches the server; a passphrase derived with Argon2id gates the actual decryption.
Public links carry a maximum lifetime and are destroyed automatically — a forgotten link is not a permanent hole.
Limit a link to a single view or a fixed number of opens, and see exactly how many times it was used.
Sensitive material can be displayed in a protected viewer with watermarking, so a screenshot carries context with it.
Creation, views, revocation and expiry are recorded in an append-only trail without revealing the file contents.
Multi-gigabyte transfers with chunked resumable upload, crash recovery and integrity verification after upload.
The convenience of a permanent public link is exactly its danger: it outlives the project, gets forwarded, ends up in a ticket and remains valid years later. Making expiry the default, and revocation instant, changes the shape of the risk.
Files are sealed before upload. A recipient's browser gets the key material through the fragment and the passphrase, decrypts locally, and the platform never observes plaintext at any point of the exchange.
Instead of an access-control list a server enforces, each member holds a copy of the folder key sealed to their own public key. Removing them rotates the remaining copies, so revocation is cryptographic rather than a promise from the backend.
Yes. Protected links open in any modern browser; decryption happens in the page.
You can show the access log entries for that link — creation, view events and revocation — with no content exposure.
No. Everything is encrypted on the device before it leaves it, with XChaCha20-Poly1305, using keys derived locally with Argon2id and wrapped per member with X25519. Our servers hold ciphertext and sealed key envelopes, so there is no admin view, no support tool and no classifier that can reach your content.
No. There is nothing to self-host and nothing to configure: you create an account, invite people by email, and encryption happens transparently in the browser and apps. Zero-knowledge here is the default, not an expert mode.
Yes. The free plan includes 1 GB with exactly the same zero-knowledge architecture as paid plans, so you can validate the workflow before moving a studio onto it.
Removing a member revokes their access and rotates the remaining key envelopes, so their old copy of the key stops opening anything new. Every membership change is written to an append-only audit trail.
Because we cannot read your data, we cannot reset it for you. Each account creates a Recovery Kit — a printable PDF with a QR code — to keep offline. That is the same property that stops anyone else, including us, from reading your workspace.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
