Most services promise privacy but retain the ability to access your data. Carbon is architected so that we cannot read your files, even if we wanted to. This isn't a policy - it's math.
We never see your unencrypted data. Files are encrypted on your device before upload using keys that never leave your control. Even if compelled by law, we can only provide encrypted blobs.
Your encrypted data is stored in Switzerland, one of the world's strongest privacy jurisdictions. Swiss law requires a Swiss court order for data requests, providing an additional legal barrier.
Don't trust us - verify. Carbon Sync provides SSH access to your storage account. You can directly inspect, download, or delete your encrypted files at any time.
Our AI features run entirely on your device. File search, organization suggestions, and smart features work without sending your data to any cloud AI service.
The cryptographic details for those who want to verify our claims.
We believe in transparency. Here's where we are and where we're going.
We're planning a comprehensive security audit by a reputable third-party firm. Results will be published publicly.
Our encryption libraries will be open-sourced for community review. Core encryption uses the well-audited age library.
Full GDPR compliance including right to erasure, data portability, and data minimization by design.
Working toward SOC 2 Type II certification for enterprise customers who require formal compliance.
When you upload a file, we receive encrypted bytes. We don't know if it's a photo, a document, or your tax returns. We can't read it, search it, or train AI on it.
This is what zero-knowledge actually means: the knowledge doesn't exist on our servers. Even under legal compulsion, we can only provide encrypted data that's useless without your key.
A note on honesty: No security system is perfect. We're transparent about what we protect against and what we don't. If someone has physical access to your unlocked device, or if you use a weak password, those are risks outside our control. Strong security requires good practices on both ends.
We're happy to discuss our security approach in detail.