Keep your files private without giving up the cloud.
Cloud Enclave encrypts files in your browser before they ever leave your device, so you keep the keys and control of access.
Why common cloud storage can expose your files
Many cloud services and workflows leave readable data on servers or rely on fragile setups.
They control the encryption keys.
When providers control keys, uploaded files can be read by the service, staff, or attackers who breach the system.
Hard to use, easy to break.
Many encryption tools need extra steps and expert setup, which raises the risk of mistakes and lost files.
Claims you can’t always verify.
Some vendors advertise "zero-knowledge" without transparent, client-side encryption. Cloud Enclave runs in-browser encryption you can inspect.
Private cloud storage in three simple steps
No setup. No expertise required. You get strong encryption with an experience as simple as any cloud drive.
Connect your cloud vault in seconds
Connect your Google Drive, OneDrive, or Dropbox account. Cloud Enclave requests only the permissions needed to store and retrieve encrypted files.
Minimal permissions · Multi-account · No data collectedYour browser locks the file before upload
Before a file leaves your device it is encrypted in your browser using your password. We do not have access to the original file, your password, or the key used to lock it.
Encrypted on-device · Password stays local · Only locked data is transferredLocked files go to your vault. You hold the key.
The encrypted file lands in your own cloud storage. When you retrieve it, your browser decrypts it locally using your password so readable data does not pass through our servers.
Stored in your vault · Decrypted in your browser · Readable data does not pass through usPrivacy-first features
Cloud Enclave keeps files private while staying easy to use.
Your files stay in your cloud, encrypted
Files are encrypted in your browser and stored in your cloud account; we do not have access to plaintext.
Credentials never leave your device
Sign-in happens client-side so your password isn't transmitted to our servers.
Compromise of one file won't expose the rest
Each file uses its own key so a single breach doesn't cascade across your vault.
Tamper detection built in
Files are signed on upload so integrity issues are detected before opening.
Decrypted only in your browser
Readable files are produced locally in your browser; servers only see encrypted data.
Multiple cloud accounts, one view
Connect Google Drive, OneDrive, or Dropbox; each appears as its own encrypted vault.
Reliable large uploads
Background uploads with progress and notifications for big folders.
Revoke access quickly
View and revoke active sessions to cut off access if a device is lost or shared.
Clear protection markers
Encrypted files have a clear extension so protected files are easy to spot.
Security design you can inspect.
Our cryptographic stack is implemented in Rust, compiled to WASM, and runs in your browser. Here is how it works.
AES-256-GCM
Authenticated encryption with unique IVs per chunk. It protects confidentiality and integrity, and tampering is detected before decryption.
Argon2id Key Derivation
Argon2id (64 MiB memory · 3 iterations · parallelism 1) derives your encryption key from your password. Its memory-hard design raises the cost of GPU and ASIC brute-force attacks. The key stays in your browser.
HMAC-SHA2 Challenge Auth
Zero-knowledge login: the server issues a nonce, your browser responds with an HMAC proof so the server can verify knowledge of the password without it being transmitted.
Rust WASM — No JS Crypto
Cryptographic operations run in a compiled Rust WASM module via a Web Worker. This gives predictable performance and avoids common pure-JS crypto pitfalls.
Uploading file
Don't take our word for it.
Verify it yourself.
We built Cloud Enclave on a simple principle: you should not have to trust us. The encryption is transparent, the libraries are open-source, and the proof is in your browser's network tab.
Audited open-source crypto
Our encryption uses RustCrypto libraries with public security audits. We did not design custom cryptography.
Read the NCC Group audit →No VC funding. No data incentive.
Cloud Enclave is bootstrapped. We have no investors demanding growth at any cost, no advertising business model, and no reason to monetize your data.
Verify it yourself
Open Developer Tools in your browser while uploading. Network requests contain encrypted bytes rather than readable file contents.
Your files live in your own cloud storage
We do not host your files. They stay in your connected storage account, which you can access directly.
We did not invent our own cryptography. We built on established open-source libraries.
I built Cloud Enclave because I needed it myself. I wanted the cloud to handle my files, but I was not willing to let it see what was inside them.
I'm a software architect with a background in web applications and security. After years of seeing "zero-knowledge" used as marketing copy, I built something you can verify in your browser's DevTools. Cloud Enclave is bootstrapped and independent, and it has to earn trust through auditable details.
Start free. Upgrade when ready.
One vault to start. Unlock everything when you're ready. No credit card required. Pro features are in development; join the waitlist for early access.
Free
Everything you need to keep your personal files private — no strings attached.
- 1 vault (any supported provider)
- Unlimited encrypted files
- Military-grade encryption
- Password never leaves your device
- Revoke cloud access anytime
- Community support
Enclave
For people who need private storage across multiple providers, accounts, and devices.
- Unlimited vaults
- Any supported provider per vault
- Everything in Free
- Priority email support
- Early access to new features
- Encrypted cross-device sharing
All plans use the same encryption.
Your files deserve privacy.
Start free today.
No credit card. No limits on encrypted files. Connect your cloud vault in under a minute and keep control of your data.
Your password stays in your browser. We do not have access to readable file contents.
Can Cloud Enclave read my files?
No. Files are encrypted in your browser before upload and the key is derived from your password, which stays on your device. We store only encrypted data and do not have the key to decrypt it.
What happens if I forget my password?
If you forget your password, we can't recover it because we don't hold your encryption key. We recommend storing your password in a password manager (Bitwarden, 1Password) or exporting recovery material. Passkey support is on our roadmap.
Where are my files actually stored?
Encrypted files are stored in your own cloud storage account, whether that is Google Drive, OneDrive, or Dropbox. Cloud Enclave stores only encrypted file metadata (filename hash, size, encryption parameters) in our database — never file content. You remain the owner of the storage.
What encryption does Cloud Enclave use?
Cloud Enclave uses AES-256-GCM. Each file is authenticated, so tampering is detected before it opens. Your encryption key is derived from your password with a memory-hard algorithm (Argon2id) to raise the cost of brute-force attacks. The full stack is documented in the Security section.
Can I connect multiple accounts or providers?
Yes. On the free plan, you get one vault connected to any supported provider. Upgrade to connect unlimited vaults across as many accounts and providers as you need. Each appears as a separate encrypted vault in the sidebar with its own OAuth connection and session tokens. You can revoke access to any vault independently. Google Drive, OneDrive, and Dropbox are supported today.
How does login work without sending my password?
Cloud Enclave uses a zero-knowledge challenge-response protocol. When you log in, the server issues a random nonce and a bcrypt salt. Your browser computes a bcrypt hash of your password with that salt, then produces an HMAC-SHA512 proof using the nonce. The server verifies the proof without ever seeing your password or your encryption key.
Will I always have to type a password for each file?
Not forever. Right now you enter a password each time you lock or unlock a file, and that password derives the encryption key locally. Passkeys are on our roadmap: your device (Face ID, Touch ID, Windows Hello, or a hardware key) will unlock the vault without typing. The key still does not leave your browser. Existing password-based vaults will have a migration path when passkey support launches.
Is the encryption code auditable?
Yes. The Rust cryptography implementation in our WASM module uses well-audited crates: aes-gcm 0.10, argon2 0.5, and hmac + sha2 from the RustCrypto project. These are open-source libraries with independent security audits.
What data does Cloud Enclave store about me?
We store your username, a one-way hash of your login credentials (never your password), encrypted file metadata, cloud storage access tokens, and session tokens. We never store your encryption key or readable file content. Your files live in your connected cloud storage.