The Everabyte encryption model

Everabyte protects your files with layered encryption. This article explains exactly what that means, what it does not mean, and what it implies for you — including how it differs from zero-knowledge and end-to-end models.

In short

Two layers of encryption protect your stored files — one at the application level and another within Everabyte’s storage infrastructure. Your decryption key remains under your control: Everabyte services cannot use it or access decrypted stored files without an operation authorized by you.

What happens to a file

1. Your device sends the file over an encrypted TLS 1.3 connection.
2. Everabyte’s application services apply application-level encryption to the file before it is written to storage.
3. Everabyte’s storage infrastructure applies an additional layer of encryption at rest to the already-encrypted file.
4. Direct access to stored objects does not reveal the original file contents.

Master key management

Everabyte protects its infrastructure master encryption keys through secure Vault-based key management. Master keys are distinct from account-controlled decryption keys and from recovery passphrases.

Owner-controlled decryption

Your decryption key remains under your control. Everabyte services cannot use it or access decrypted stored files without an operation authorized by you.

During an authorized upload, Everabyte services process your content before application-level encryption is applied. This normal processing is not access to your stored files — do not confuse the two.

Recovery passphrases

Your recovery passphrase enables you to restore your encrypted files through Everabyte’s secure recovery process. Keep it secure, never share it, and store it separately from your devices.

What this model is not

Everabyte is not a zero-knowledge or end-to-end encrypted product. Everabyte’s application services apply the first encryption layer inside the platform, so the service sits within the protected path. The model still guarantees that stored objects never expose file contents on their own, and that decryption requires an operation you authorize.

This matters if you are comparing providers: some competitors encrypt on your device with keys the provider never holds. Everabyte does not. For a plain-language tour of these terms, see Zero-knowledge and encryption models explained.

The same model everywhere

This encryption model applies across the storage platform, including white-label deployments. If you use Everabyte through a white-label brand, the underlying protection is the same. Dedicated servers and custom modules can differ — your order form or DPA states what applies.

Common issues

Is layered encryption the same as end-to-end encryption?

No. End-to-end encryption means only the endpoints hold the keys. With Everabyte, the application services apply the first encryption layer, and the storage infrastructure adds a second layer at rest; decryption requires an operation you authorize.

Does the encryption apply to shared files?

Yes, stored files — shared or not — keep application-level encryption, with the storage-level layer on top. Sharing settings control who can access shared content; see our sharing best practices.

Can Everabyte read my files?

Direct access to stored objects does not reveal the original file contents, and your decryption key remains under your control: Everabyte services cannot use it or access decrypted stored files without an operation authorized by you. We do not use the content of your files for advertising, profiling or AI training. See Can Everabyte read files.

Where can I read about the security layers around it?

See How we protect your files for TLS 1.3, layered encryption, Vault-backed key management, retention controls and threat detection.