Security
Last reviewed October 12, 2026
Where we stand, item by item. Each says plainly whether it’s in place or not yet, and nothing here is booked unless it says with whom and when. How the encryption works is on How zero-knowledge works.
Independent security auditNot yet
No outside firm has reviewed Terebyte’s code or encryption yet, and none is booked. When one is, this says who and when; when it’s done, the full report goes here.
Penetration testNot yet
No outside penetration test has been done yet, and none is booked.
SOC 2Not yet
Terebyte has no SOC 2 report.
ISO 27001Not yet
Terebyte has no ISO 27001 certification.
Data processing agreement (DPA)Not yet
We don’t offer a signed data processing agreement yet. What we do with personal information is in the Privacy Policy.
HIPAA and business associate agreementsNot yet
We do not currently sign business associate agreements.
Bug bountyNot yet
We don’t pay rewards for reports yet. We do welcome them, and promise not to pursue anyone who follows our disclosure policy (next item).
Vulnerability disclosure, with safe harborIn place
Found a security problem? Write to security@terebyte.com. The disclosure policy says what’s in scope, how we reply, and the safe harbor we give researchers who act in good faith. It’s also listed in /.well-known/security.txt.
SubprocessorsIn place
These companies process information for us, under contracts that limit its use to providing their service to us. Our storage and download providers only ever handle encrypted files. The same list is in the Privacy Policy.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosts the website and app; runs the bot check (with Kasada); keeps short-lived request logs | United States |
| Neon | Hosts our database (account and file information listed in section 2, on Amazon Web Services) | United States |
| Backblaze | Stores your encrypted files, and our encrypted database backups | United States |
| OVHcloud | Runs our download servers, which pass encrypted bytes from storage to your browser and keep no access logs | United States |
| Resend | Sends our emails (sign-in links and service notices), and receives email sent to our addresses | United States |
| Stripe | Payments (see section 5) | United States and worldwide |
| GitHub | Runs our nightly database backup, which is encrypted as it’s made, with a key only we hold, before it’s stored | United States |
| Hosts the mailbox where emails you send to our addresses arrive | United States |
Transparency reportIn place
Up to October 12, 2026: 0 requests received from any government, police force or court, and no copyright notices. The transparency report has the detail, and each new report is added there.
More
- Security whitepaper: the design in full.
- Threat model: what Terebyte protects against, and what it doesn’t.