Zero-knowledge, by design.
Not by marketing.
Here's exactly how Everabyte protects your files — from the moment they leave your device to the encrypted blobs sitting in our storage. No hand- waving. No 'military-grade' claims without specs.
Four guarantees that drive every engineering decision.
Zero-knowledge by design
We never see your plaintext. Files are encrypted on your device, before they touch our network. Even our engineers cannot decrypt your data — and our infrastructure is designed so we cannot be compelled to.
You own the keys
Encryption keys are derived from your password via PBKDF2-HMAC-SHA256 (600,000 iterations) and never leave your device. Lose your password = lose your data. We do this on purpose.
Encrypted at rest and in transit
AES-256-GCM at rest, TLS 1.3 in transit, with HSTS preloaded and certificate pinning on mobile clients. Every file chunk is encrypted with a unique per-file key.
Immutable WORM backups
Backups are write-once-read-many (WORM). Even an attacker with root access on our servers cannot delete or alter your historical versions for the retention period.
From your device to immutable backup, in 6 layers.
Every layer adds an independent safeguard. No single point of failure, no single point of trust.
Your device
AES-256-GCM keys are derived locally from your password. The plaintext file is encrypted in memory before any network call.
Auth + key exchange
You authenticate with Argon2id-hashed credentials. The session token never exposes your encryption key to the server.
TLS 1.3 transport
Ciphertext travels over TLS 1.3 only. HSTS preloaded. Modern cipher suites (X25519MLKEM768, ChaCha20-Poly1305).
Encrypted storage
Each chunk stored as opaque ciphertext in our object store. Per-file keys wrapped by a per-account key wrapped by your password-derived key.
WORM backups
Geographically distributed immutable backups across 7 datacenters (US, EU, APAC). 30-day version history per file by default.
Monitoring & audit
All admin actions logged and signed. Anomalies trigger automatic lockouts. SOC 2 Type II audit Q3 2026.
What we protect you from.
We document what we do — and don't — protect against. Honest threat models > vague security marketing.
Server breach
ProtectedAttacker gets only ciphertext. No plaintext, no keys.
Insider threat
ProtectedWe cannot decrypt your data. No backdoor. No master key.
Compelled disclosure (legal)
LimitedWe can only hand over encrypted blobs. We cannot break encryption.
Lost password
Data lossBy design. This is the cost of true zero-knowledge. Recovery keys are recommended.
Compromised device
DependsIf your device is malware-infected mid-session, consider data compromised. Hardware keys (FIDO2) recommended for high-risk users.
Mapped to the regulations that matter.
Want the full technical deep-dive?
Download our Zero-Knowledge Engineering Playbook (48 pages) — full architecture diagrams, key derivation code samples, performance benchmarks, and the audit checklist we use internally.