The infrastructure behind a zero-knowledge service

When you cannot read user data, your servers do a different job. A look at how we run storage, keys and backups without holding the keys.

A zero-knowledge backend is mostly a very careful storage and routing system. The interesting work is everything we deliberately do not do.

What our servers hold

• Encrypted blobs and their metadata
• Wrapped keys we cannot unwrap
• An append-only oplog for sync

What they never hold

Plaintext, master passwords, or unwrapped content keys. Backups are encrypted with the same scheme as live data, so a restored backup is exactly as private as the original.

The safest data to operate is the data you cannot read.