The questions
people actually ask.

With the backup code printed at sign-up, you set a new password and the data stays intact. Without it, the data is permanently inaccessible: there is no recovery procedure and it does not matter whether you can prove you own the account. The key is computed from your password and we do not hold it, so there is nothing for us to reset.

No. Files are encrypted on your device, with a key derived from your password, before being transmitted to us. We see the size, the date and the shape of the folder tree, but not file names and not content. The full list is on the What the server sees page.

We provide what we hold: email address, billing data, IP addresses and encrypted blocks. We do not hold the decryption key, so we cannot provide readable content, not even under legal compulsion. This is not defiance, it is technical impossibility.

In the current version, nothing automatic. The vault does not open itself for anyone and there is no mechanism to detect death. If you want your family to get in, you must leave them the printed backup code while you are alive. An automatic key handover mechanism is in preparation, but we do not promise it as available.

As long as you know your password, you generate a new code from settings at any time. We also ask you to confirm every six months that you still have it; if not, we regenerate it. A code you can no longer find is not a backup code.

The account moves to the free 30 MB plan at the end of the paid period. If your data exceeds 30 MB, you get 30 days of grace and three notices, then we automatically delete the oldest files until you fit. Data is not deleted at the moment of cancellation.

You can upload up to 150% of the space you paid for. Beyond that, uploads are refused. Between 100% and 150% you have 30 days to get back within it, with five notices, then we automatically delete the oldest files. Deletion is permanent and does not pass through the trash, because we cannot choose for you what to keep.

We give at least 90 days notice. Export stays available throughout. We publish the decryption client code, so that with your exported blocks and your password you can recover your data without us. For plans paid for ten years we refund the unused period pro rata, within the association available funds.

On a server in Romania, at Chroot Network SRL. We do not yet have replication across multiple locations, and when we do we will name the data centres rather than speak in general terms. Our recommendation remains to also keep your own copy of anything you cannot afford to lose access to.

We publish the code that performs the encryption, the digests of the delivered bundles, and how to rebuild them. You can check, in your own browser, what is sent to the server: you will not find the password, nor the key. One real limit remains: we deliver the code, so in theory we could deliver a modified one. We write that out explicitly on the security page, along with what we do to make it verifiable.

No. We do not have ISO 27001, we do not have SOC 2, and we do not claim to. If we obtain one we will publish it together with the attesting document. Until then, judge us by the published cryptographic parameters, which are verifiable now.

The Cyber Security Education Association, a Romanian non-governmental non-profit founded in 2023, tax ID 48106635, registered in Ștefăneștii de Jos, Ilfov County. We have no investors, so we have no pressure to sell or to monetise data.