Uploading Files and Folders to Your Encrypted Vault

On most cloud drives, "upload" means "send the file to the server, then it gets encrypted." On a zero-knowledge cloud, the order is reversed — and that reversal is the whole point. Here's what actually happens between dropping a file and seeing it appear in your vault.

Three ways to get files in

The vault accepts files three ways, all landing in the same place:

• Drag and drop — drag files or entire folders from your desktop straight onto the vault window. A drop zone highlights to confirm the target.
• The Upload button — opens your system file picker for one or many files at once.
• Folder upload — select an entire folder and its contents upload preserving the relative path, so a shoot folder with subfolders arrives intact rather than flattened into one pile.

What happens before a single byte leaves your device

This is the part that's different from Google Drive or Dropbox. Before any upload request is sent:

1. Your vault's encryption key — derived from your password via PBKDF2, entirely in your browser — encrypts the file with AES-256-GCM.
2. The filename itself is encrypted too, along with a random initialization vector (IV) generated for that specific file.
3. Only the resulting ciphertext, the encrypted filename, and the IV are sent to the server.

The server never sees a plaintext filename, a plaintext byte, or your encryption key at any point in this sequence. If you want the deeper mechanics of why that's structurally different from "encryption at rest," see our zero-knowledge encryption explainer.

What the free trial and paid plans actually allow

The free trial's 10-file, 50 MB-per-file ceiling exists to let you test the upload and encryption flow without committing — it's not meant for real backup volume. If you hit the quota mid-upload, the file that would push you over is rejected with a clear "storage quota exceeded" message rather than silently failing.

What happens if an upload gets interrupted

Because encryption happens locally before the network request starts, a dropped connection or closed tab simply means the upload didn't complete — there's no partially-encrypted or corrupted file sitting on the server. Nothing is written to your vault's file list until the encrypted blob is fully received and acknowledged. Just re-upload the file; there's no cleanup step required on your end.

Organizing as you go

You don't have to dump everything into one flat list. Create folders before or after uploading, and drag files into them the same way you'd organize a local desktop. Folder uploads preserve their internal structure automatically — a "Trip 2026 / RAW / Day 1" hierarchy from your computer becomes the same hierarchy in your vault, not one folder with hundreds of loose files. For a full walkthrough of folders, sorting, and navigation once your files are in, see the organizing your vault guide.

A practical note on upload speed

Client-side encryption adds a small amount of local processing time before the network transfer starts — for most files this is imperceptible, and for very large files (multi-gigabyte video exports) it's still dwarfed by your actual upload bandwidth. There's no server-side "processing" delay afterward, either: once the encrypted blob arrives, it's stored as-is.