Threat model

What Terebyte is for

Keeping the contents and names of your files private from everyone you haven’t shared them with. That includes us, the companies that host us, and anyone who breaks into or seizes our systems. It does this by encrypting on your device, with keys we never have.

Who might want your files, and what they could get

Terebyte, or anyone who works here

Protected: file contents, file and folder names, file types, your passphrase and recovery key, share-link secrets. We never have the keys.

Not protected: what our servers see by design: your email address, plan and payments, how much you store and download, the size and time of each upload, and how your folders nest. See also “The code we send you”, below.

Someone who breaks into our servers, database or storage

Protected: file contents and names, which are stored only encrypted.

Not protected: the account information above. A copy of our database also holds each vault’s passphrase-sealed key. So an attacker could try to guess your passphrase offline, at the cost of 600,000 PBKDF2 rounds a guess. A long, unique passphrase makes that useless; a short or reused one doesn’t.

The companies that host us (cloud, storage, download servers, email)

Protected: file contents and names. Storage and the download servers only ever handle encrypted bytes.

Not protected: what each needs to do its job: for example, the email provider sees your address and that we sent you a sign-in link.

A government, police force or court that demands information from us

Protected: file contents and names, passphrases, recovery keys and share-link secrets. We can’t hand over what we can’t decrypt.

Not protected: the account information we hold, which we must give in answer to valid legal process. Counts of requests are in the transparency report.

Someone watching the network (public Wi-Fi, an internet provider)

Protected: everything you send and receive, which is encrypted on your device and sent over HTTPS as well.

Not protected: the fact that you’re using Terebyte, when, and roughly how much you upload and download.

Someone who gets into your email

Protected: your files. Signing in needs your email; opening the vault needs your passphrase or recovery key, which aren’t in your email.

Not protected: your account itself: they could sign in, see your plan and storage totals, change things that don’t need the vault unlocked, and ask to close your account. Closing takes 14 days, is emailed to you, and is shown every time you sign in, with one click to keep the account. Protect your email account with a strong password and two-step sign-in.

Someone you send a share link to, or who finds it

Protected: everything in your vault except what that link shares. You can add a password and an expiry, and turn the link off.

Not protected: what the link shares, while it works. Once someone has downloaded a file, turning the link off can’t take their copy back.

The code we send you

Protected: against scripts injected by anyone else. A strict Content Security Policy lets only our own scripts run.

Not protected: against us. Terebyte is a web app today: your browser runs the code we send on every visit. If our servers were taken over, or we were forced to, a changed app could capture your passphrase as you type it. Native apps, whose code is installed and signed, are what we’re building next. See the honest caveat.

Malware on your device, or someone using it while your vault is unlocked

Protected: nothing extra. Your device is where your files are readable.

Not protected: anything that device can see. Keep it updated, lock it, and set a short time under Settings → Auto-lock on shared computers.

You, if you lose your passphrase and your recovery key

Protected: —

Not protected: your files: nobody can decrypt them, not even us. Keep the recovery key offline, somewhere safe.

What Terebyte isn’t

• Not anonymous. An account needs an email address, and paid plans are paid by card. We know who our members are to the extent their email and payment show it.
• Not a hiding place for metadata. Sizes, times and folder structure are visible to us.
• Not independently reviewed yet. No outside firm has reviewed our code or encryption. Our status is on Security.
• Not a backup of a lost key. We can’t recover files for you.