Zero-knowledge and encryption models explained

Cloud providers use a small vocabulary of encryption terms, and they do not all mean the same thing. This article explains each model in plain language, then states clearly which one Everabyte uses.

Zero-knowledge

In a zero-knowledge model, the provider never holds the key that decrypts your data. You encrypt on your device; the provider stores ciphertext it cannot open. The consequence is also its limit: if you lose your key, the provider cannot recover your data.

Everabyte is not a zero-knowledge provider. Its application services apply the first encryption layer inside the platform.

End-to-end encryption (E2EE)

End-to-end encryption means only the endpoints — typically your devices — hold the keys. The service in the middle only ever sees ciphertext. Messaging apps popularized the term; some storage products apply it to specific folders rather than the whole account.

Everabyte does not claim end-to-end encryption.

Client-side encryption

Client-side encryption means encryption happens on your device before anything is uploaded. It is the mechanism that makes zero-knowledge and E2EE possible.

Everabyte does not claim client-side encryption. The first encryption layer is applied by Everabyte’s application services.

Server-side and layered encryption

Server-side encryption means the provider’s services encrypt data before it is written to storage. Everabyte goes one step further with layered encryption:

1. Application-level encryption applied to files before they are written to storage.
2. Storage-level encryption at rest, applied inside Everabyte’s storage infrastructure.

Two layers, one result: direct access to stored objects does not reveal the original file contents.

Owner-controlled decryption

Your decryption key remains under your control. Everabyte services cannot use it or access decrypted stored files without an operation authorized by you. This is the control that matters most day to day: stored files are only decrypted through operations you authorize.

Recovery passphrases

A recovery passphrase lets you restore your encrypted files through Everabyte’s secure recovery process. It is not your login password, and it is not the infrastructure master key — it is your personal safety net. Keep it offline, secret and separate from your devices.

Vault-backed key management

Everabyte protects its infrastructure master encryption keys through secure Vault-based key management. Master keys are a platform concern; they are distinct from your account’s decryption key and your recovery passphrase.

Which model does Everabyte use?

Property	Everabyte
Zero-knowledge	No
End-to-end encryption	No
Client-side encryption	No
Layered encryption (application + storage level)	Yes
Owner-controlled decryption	Yes
Recovery passphrase	Yes
Vault-backed master key management	Yes

For the full details, see The Everabyte encryption model.

Common issues

Why doesn’t Everabyte use zero-knowledge?

Everabyte applies its first encryption layer in the application services and adds a storage-level layer at rest, with owner-controlled decryption deciding who can decrypt stored files. That is a deliberate architecture choice, not a shortcut.

Is layered encryption weaker than client-side encryption?

They are different models with different guarantees. Layered encryption with owner-controlled decryption protects stored files — direct access to objects reveals nothing — while keeping recovery practical through your recovery passphrase.

Where do I learn what Everabyte protects beyond encryption?

See How we protect your files for retention controls, versioning, malware and anomaly detection.