Stored as ciphertext
Files are encrypted with AES-256-GCM by the Everabyte storage pipeline before they are written to disk.
Secure cloud storage
Encrypted in transit and at rest. Clear about how.
AES-256-GCM protects stored files, TLS 1.3 protects transfers, and every request is checked against your access rules. Here is exactly what that means.
- AES-256-GCM at rest
- TLS 1.3 in transit
- Provider-managed keys
Transfer over TLS 1.3Browser, API or Desktop Agent to EverabyteIn transit
Encrypted with AES-256-GCMApplied by the Everabyte storage pipelineSSE
Stored as ciphertextIn the storage region selected for the accountAt rest
Access checked per requestSession, role and sharing rules are evaluatedAuthorized
Encryption keys are managed by Everabyte in standard plans. No client-side key custody is claimed.
How a file is protected between your device and the storage layer. Keys remain inside the Everabyte service.
Protection layers
Four layers, four different jobs
Encryption is not one setting. Storage, transport, authorisation and logging each answer a different question.
Protected on the wire
Browser, API and Desktop Agent transfers use TLS 1.3 between the client and the Everabyte service.
Checked per request
Session, role and sharing rules are evaluated before a file is listed, previewed or downloaded.
Actions recorded
Administrative and file events are written to the activity log on plans that include audit logging.
Key responsibility
Who holds the keys matters
Many providers describe encryption without saying who can decrypt the data. Our model is layered encryption — application level plus storage level — with owner-controlled decryption.
- Keys are managed by Everabyte in standard plans. Encryption and decryption happen in the service, not in your browser.
- Everabyte applies application-level encryption before storage, plus a storage-level layer at rest. It is not end-to-end encryption and not a zero-knowledge model.
- No client-side key custody is claimed. Customer-managed keys and HSM-backed key escrow are not part of the standard offer.
- Account security still matters. Use strong credentials, protect administrator accounts and review connected sessions.
Algorithm AES-256-GCMAt rest
Transport TLS 1.3In transit
Key management Everabyte-managedSSE
Not offered E2EE, zero-knowledge, CMKExplicit
Applies to standard plansConfirm exceptions in your contract
Read the claim, not the adjective
“Encrypted cloud storage” can mean several architectures. On this page it means server-side encryption with provider-managed keys, protected transport and authorisation checks — nothing more.
Storage is not backup
Why encrypted storage still needs a backup
Encryption protects confidentiality. It does not restore a file that was deleted, corrupted or encrypted by ransomware. That is a separate job.
| Question | Secure cloud storage | Cloud backup and archiving |
|---|---|---|
| Primary purpose | Daily access, collaboration and sharing | Recovery after deletion, corruption or ransomware |
| What it holds | The working copy your team uses | Additional copies captured on a schedule |
| Deletion behaviour | Trash and version history, then removal | Retained restore points until retention expires |
| Recovery test | Restore a version or a file from trash | Preview a restore point and verify the result |
| Best next step | Explore backup and archiving | Download the Desktop Agent |
Product fit
Three products, one security baseline
Encryption and access control apply across the range. What changes is the level of administration, integration and infrastructure around it.
EverSpark
Individuals and small projects
- Personal storage with encrypted files
- Protected sharing links
- Web and mobile access
EverStream
Teams and growing businesses
- Shared team workspaces and roles
- API access with scoped keys
- Object storage buckets
EverBlaze
Organisations with governance needs
- Advanced user administration
- White Label and managed private environments where agreed
- Deployment scoping with our team
Plan inclusions and capacities vary. Confirm White Label, managed private environments and support terms in your order form.
Before you decide
Three questions we will ask
Where must the data live?
Storage region is selected during deployment. Residency requirements are part of the scoping conversation, not a checkbox.
What must be recoverable?
Define which files need backup, how often, and for how long. Storage alone does not answer that question.
Who tests the restore?
A backup you have never restored is a hypothesis. Plan a test restore before you rely on the schedule.
Bring your security questionnaire
Tell us which data you hold, where it must be stored and who must be able to recover it. We will answer with the architecture we can document, not a badge.
No zero-knowledge, end-to-end encryption or customer-managed key capability is claimed.