Your data, even when our servers don't cooperate.
DRIVUNO's zero-knowledge architecture has a powerful side-effect for durability: because the server only ever holds ciphertext, every backup is automatically a safe backup. There is no readable copy to leak, anywhere.
Snapshots, encrypted before they leave our perimeter
Database and file snapshots are encrypted before they ever leave the primary environment, then shipped to a dedicated EU off-site backup tier. What lands in the backup tier is exactly as unreadable to us as the live data — there is no readable copy at any stage.
Immutability lock in the EU
Backups sit in the EU under a 30-day immutability lock: once written, a snapshot cannot be modified or deleted by anyone, including DRIVUNO staff, until the lock expires. This closes off ransomware- and insider-style tampering with backup history.
Backup master key wrapped with Argon2id
The key that protects the backup tier is itself wrapped using Argon2id, following the same key-wrapping discipline we apply to your master key. There is no plaintext backup key sitting next to the backups it protects.
Immutable audit log
Every privileged action — restores, key rotations, account deletions — lands in an append-only audit table that even DRIVUNO administrators cannot edit.
Restore drills
We periodically run restore drills against the backup tier to verify that recovery actually works end to end, not just that snapshots exist.
Your offline Recovery Kit
The strongest guarantee: even if every DRIVUNO server vanished tomorrow, the Recovery Kit you printed at sign-up still re-wraps your master key. Your password plus your printed key equals access — no third party required.
What we cannot recover for you
If you lose your password and your Recovery Kit, your vault becomes mathematically unrecoverable — and that holds true whether we restore from the live database or from an off-site backup, because backups are exactly as unreadable to us as live data. This is not a bug — it's the proof that we never had your data in the first place. Print your Recovery Kit. Store it like a banknote. That single sheet of paper is the difference between guaranteed durability and permanent loss.
Download my Recovery KitFrequently asked
Where are the encrypted backups stored?+
In a dedicated EU off-site backup tier, separate from the live environment, under a 30-day immutability lock. All copies are ciphertext only — even a leaked backup discloses nothing.
Can a court order force you to hand over a readable copy?+
No. We physically cannot produce plaintext, from live data or from backups. We can only hand over the same ciphertext the user uploaded, which is useless without their password and key.
How long are deleted files kept?+
Trash holds files for 30 days before permanent purge. After purge, the encrypted blob is irrecoverably overwritten in storage and removed from all snapshots within the retention window.
How do you know restores actually work?+
We run periodic restore drills against the backup tier so recovery is verified in practice, not assumed.
Last reviewed: 2026-08-05. See also the architecture overview and the security changelog.