The short version

Anchor Cloud encrypts your files on your device, before they ever leave it. The key that can decrypt them is derived from your password and never sent to our servers. What reaches us — and what we store — is ciphertext: unreadable without a key we don't have.

What "zero-knowledge" means here

It's a specific, narrow claim: our server cannot read the contents of your files. It's not a claim that we can't see anything at all — metadata like file name, size, MIME type and upload date passes through in the clear, because features like search, storage quotas and the file list need it to function. We think pretending otherwise would be dishonest, so we don't.

What the server can and can't see

• Can see: file name, size, extension, MIME type, upload timestamp, SHA-256 hash of the ciphertext.
• Cannot see: the decrypted contents of any file, ever — not during upload, not at rest, not if we wanted to.

This is also why Anchor AI only ever reasons over that metadata, never file contents — the assistant is built to respect the same boundary the encryption enforces.

Encryption details

• Files are encrypted client-side with AES-256 before upload.
• Your encryption key is derived from your password and kept on your device — we never transmit or store it.
• Sharing a file re-encrypts a copy of the key for the recipient's public key, so we still never handle a readable key.

Where the exceptions are

We'd rather scope an exception narrowly and say so than blur the line. Community groups (opt-in, not the default) are server-readable by design, so @fathom can participate and moderation can work — that trade-off is explicit, and private groups remain end-to-end encrypted.

Reporting a vulnerability

Found a real security issue? Email [email protected] with details and we'll respond directly — we're a small team, so you'll hear from an actual engineer, not a ticket queue.