Security incidents
Updated October 28, 2026
A security incident is anything that may have exposed information we hold, or let someone into the service who shouldn’t be there. This is what we do when one happens. Because files and their names are encrypted on members’ devices and we never hold the keys, an incident at our end can’t expose what’s inside your files. What it could expose is the account information we do hold, listed on our Privacy Policy. The one exception is labelled wherever it appears: objects a program stores through our S3 endpoint with a plain key are kept as sent, so an incident could expose those.
Who leads
Every incident has one lead at Terebyte, who decides each step and keeps the record of what happened and what was done. The lead brings in the companies that help us run the service where the incident touches their part, and our lawyer before anyone is notified.
The first 24 hours
- Contain. Stop it getting worse: close the way in, turn off what was misused, and replace any credential that may have been seen.
- Preserve. Keep what shows what happened, before anything is cleaned up, so the facts can be checked later.
- Assess what was exposed. Which accounts, which records and which dates. Apart from those plain-key objects, file contents, file and folder names, passphrases and recovery keys never reach us, so they can’t be among it. We still check, and say exactly what was.
- Notify. Prepare the notices below and post a first notice on our status page when members are affected, even before every fact is known.
Who is told
- Affected members, by email where the account has an email address. Accounts without one can’t be reached that way; the notice on the status page is for them too.
- An organization whose people are affected, through the person who runs its account.
- For a Base in HIPAA mode, the Covered Entity that signed its Business Associate Agreement. Because we can’t read what the Base stores, the notice names the affected accounts and the Base and says what is known; the Covered Entity identifies the individuals.
- Regulators, where the law requires it.
When
Without unreasonable delay, as soon as we know enough to say what happened and who is affected. A notice may come in parts: what we know first, the rest as we learn it.
For a Base in HIPAA mode, no later than 10 days after we discover the incident, as the Business Associate Agreement it signs today promises. A Base that signed the agreement’s first version is told within the time that version sets, no later than 60 days.
What a notice says
- what happened, and when it began, was discovered and ended;
- who was affected;
- what information was or may have been involved;
- what we’ve done, and what you can do;
- whom to contact with questions.
The public notice
Incidents that affect members are announced on our status page, and each notice there is updated until the incident ends. A notice never names a member.
Tell us
If you think you’ve found a security problem, write to security@terebyte.com: see Report a vulnerability. Questions about a notice you received: privacy@terebyte.com.