Choosing how your files are protected
When your workspace is created you choose one of three settings. It applies to the whole account: every device you add later inherits it.
Standard
Files are stored as they are in your own private bucket. Share links work, and nothing can lock you out of your own data. CDNShark can read the files.
Client-side encryption
Files are sealed on your device before upload, so our storage only ever holds ciphertext. The key is issued and kept by CDNShark, which means a forgotten password is never fatal — but it also means we retain the ability to decrypt. Share links are disabled.
End-to-end encryption
The same sealing, but the key is locked with a passphrase created on your device and never sent to us. We cannot read your files, and we cannot reset your passphrase. You are given a one-time recovery code at setup. Share links are disabled.
What encryption does not hide
In all three settings, file names, folder structure, sizes and timestamps stay readable — only the contents of files are encrypted. Your devices need that information to work out what changed. If your file names are sensitive, take that into account.
Changing your mind
Switching later erases everything stored on the server, including version history, because files written under one setting cannot be read under another. Your local files are untouched and upload again. See Changing your encryption setting.