Writing on privacy, encryption,
and building in Europe.
Technical deep-dives, infrastructure decisions, and honest takes on what it means to build software that genuinely respects your data.
Open source vs "trust us": how to verify a cloud storage privacy claim before you switch
A privacy claim you can't check is just marketing. Here's how to verify a cloud storage provider's encryption and "open source" claims yourself — with the Proton Lumo overclaim and the Mullvad raid as the cautionary and the proof.
How a Zero-Knowledge Backend Is Architected: Storing Data You Cannot Read
A zero-knowledge server only ever sees ciphertext, which quietly breaks search, dedup, and previews, and changes exactly what a breach can leak. Here's the full backend picture, and how to check a provider's claim is architectural, not marketing.
Why European Companies Are Leaving US Cloud Providers in 2026 — and What to Check Before You Do
European sovereign cloud spending jumps from $6.9B to $12.6B in 2026, and the Tech Sovereignty Package gave it a regulatory push. But a European flag on a pricing page is not jurisdiction. Here is what to actually check.
Collect Files From Clients Without an Account — and Without the Host Reading Them
Dropbox and OneDrive file requests let anyone upload without an account, but the host still holds the keys. Here's how to collect client files accountless and sealed to a key only you can open.
The True Cost of Cloud Storage: The Five Line Items the Per-GB Price Hides
Object storage advertises a low per-GB rate, then bills you for egress, requests, cold-tier retrieval, and replication on top. Here are the five meters behind a cloud bill — and why a flat per-TB price removes four of them.
Self-Hosting Nextcloud vs a Managed Zero-Knowledge Provider: The Honest Cost-and-Effort Breakdown
A small VPS costs a few euros a month. The real Nextcloud bill is your time, your backups, and your 2 a.m. on-call. A fair look at DIY sovereignty versus letting someone run the server while you keep the keys.
A Recovery Phrase for Your Files, Not Your Coins: How BIP39 Backs Up Encrypted Storage
The 12 words you'd write down for a crypto wallet do the same job in encrypted storage — they back up the master key that decrypts your files. Here's how BIP39 works, why Beebeeb uses it, and the honest catch: we can't recover it for you.
What an Encrypted Cloud Provider Can Actually Hand to the Police
A court order compels everything a zero-knowledge provider holds and nothing it doesn't. Here's exactly what's producible: account metadata yes, decryptable file contents no — because the keys never leave your device.
Anycast, DNS Failover, and Round-Robin: How Traffic Actually Finds a Healthy Server
Routing a user to a live backend isn't one decision — it's three stacked layers: anycast at the network, DNS failover at resolution, proxy health checks at the connection. Each fails differently, and the failures compound.
Can Your Cloud Provider Train AI on Your Files? Most Can. Here's the One Architecture That Can't
LinkedIn, Meta, and Atlassian all flipped stored content into AI training data by default. The only providers that structurally can't are the ones holding nothing but ciphertext.
The honest guide to leaving Google Drive, Dropbox, iCloud or OneDrive for an EU cloud
Pick a provider whose company — not just its servers — sits under EU jurisdiction, ideally zero-knowledge and open-source. Export your files, verify the copy, then bulk-move via CLI or WebDAV. You trade some integration convenience for real jurisdiction and no lock-in.
How to share a file with an expiring, password-protected link we can't read
Most "secure share links" are only secure from the public — the provider still holds the keys. Here's how to send a file with an expiring, password-protected link where the decryption key never touches our servers, plus max-opens and cryptographic revocation.
What Does 1 TB of Cloud Storage Actually Cost? Consumer Plans Compared Per TB
Flatten every plan to one number — cost per terabyte — and iCloud and Google win on raw price at about $5/TB. But the cheap number buys storage they can read, and that is a different product from one only you can decrypt.
Germany vs Switzerland for Privacy: The Jurisdiction Comparison Nobody Does Honestly
"Swiss privacy" is doing heavy lifting in 2026. With the VÜPF revision pushing IP retention and a decryption clause by decree — and Proton shipping servers to Germany — here's the honest legal comparison, including where Switzerland still wins.
Zero-knowledge storage, explained without the hype — and how to verify it yourself
Zero-knowledge cloud storage encrypts your files on your device before they upload, with keys only you hold. The provider stores ciphertext it can't read, scan, hand over in readable form, or train AI on. That's stronger than "encryption at rest", where the provider keeps the keys and can decrypt wh
Passkeys Explained: How Logging In Without a Password Actually Works
A passkey swaps your password for a key pair: the private half never leaves your device, so there is nothing to phish or leak in a breach. Here is what WebAuthn does under the hood, and why it beats a password.
Schrems II in 2026: Is Moving EU Data to a US Provider Still Legally Risky?
The Data Privacy Framework is still valid in 2026 — but a pending CJEU appeal, a PCLOB without a quorum, and a looming NOYB challenge make a US-provider setup a bet, not a settled question. Here's the honest TIA math.
Most Private Cloud Storage in 2026: How to Tell Real Zero-Knowledge From Marketing
Five questions cut through the "secure cloud storage" noise: where encryption happens, who holds the keys, whether the clients are open source, the jurisdiction, and whether the audit is real. Here's how the serious providers actually score.
NIS2 and DORA: What They Actually Require From Your Storage (a 2026 Checklist)
For storage, NIS2 (transposition deadline 17 October 2024; enforcement ramping) and DORA (in force since January 2025) demand five concrete things: state-of-the-art encryption with a written cryptographic policy, crypto-agility and post-quantum readiness, EU-resident keys you control, a register of
How to Encrypt Photos Before Uploading to the Cloud (Without a Separate Tool)
The usual advice is to staple Cryptomator or 7-Zip onto Google Photos and hope you never skip a step. Client-side-encrypted storage encrypts every photo on your device before upload by default, with no separate tool and no plaintext escape hatch.
How We Run PostgreSQL With Zero-Downtime Failover: Patroni, Explained From Scratch
A single Postgres node is a single point of failure. Here's the pattern that survives a database server dying mid-write — Patroni, a leader lease in etcd, streaming replication, automatic failover — explained from first principles, the way we run it.
OneDrive Alternative for EU Teams: Leaving Microsoft 365 Lock-In Without Losing GDPR Footing
Microsoft 365 is good software owned by a US company — and Microsoft's own lawyer told the French Senate, under oath, that he can't guarantee your data stays out of US hands. Here's how EU teams move the files that matter.
Is your cloud storage subject to the US CLOUD Act? A plain-English guide for EU businesses
If your cloud provider is a US company, the CLOUD Act reaches your data — even when it sits on servers in Frankfurt or Dublin. The 2018 law compels US firms to hand over data they control, anywhere on earth, on a valid US demand. EU servers and "sovereign cloud" branding don't change who can be comp
Your Password Never Leaves Your Device: How OPAQUE Logins Work
Most "secure" logins still hand your password to the server inside TLS, where a stray log or a compromised process can leak it. OPAQUE proves you know your password without ever transmitting it — here's the mechanism, honestly.
GDPR-Compliant Cloud Storage: What "Compliant" Actually Requires
There is no GDPR certificate. "Compliant" is a property of your processing, not a badge a vendor grants — and the badge stays silent about Article 28 DPAs, sub-processor lists, and US legal reach.
Is Google Drive Encrypted? Why Google Can Read Your Files (and How to Fix It)
Google Drive encrypts your files in transit and at rest, but Google holds the keys, scans your content, and can hand readable files to US authorities. Here's what that means and how zero-knowledge storage closes the gap.
Sovereignty Washing: Why a US "Sovereign Cloud" Still Isn't Sovereign
Sovereignty washing is selling a US-owned cloud as "sovereign" because it sits in an EU datacentre. It isn't. Jurisdiction follows the company, not the disk, so the US CLOUD Act still reaches the data. Real sovereignty needs EU ownership plus zero-knowledge encryption: the only claim that survives a
Egress Fees Are the Real Cloud Storage Bill: Why $23/TB Becomes $113/TB on AWS
S3 storage looks like $23/TB until you read it back at $0.09/GB and the bill hits $113/TB. Egress, not capacity, drives the cloud invoice — and the pricing page buries it in a footnote.
iCloud Storage Maxed Out at 12 TB? The Real Cost of Apple's Ceiling vs Scaling Past It
iCloud+ stops dead at 12 TB for €59.99/month, and there is no plan above it. Here's the real per-TB math, where Apple is genuinely cheaper, and when scaling past the ceiling is worth the move.
AES-256-GCM in Plain English: The Cipher That Locks and Tamper-Checks Your Files
AES-256-GCM doesn't just scramble your data — it produces an authentication tag, so altering one bit of ciphertext makes decryption fail instead of returning a corrupted file. Here's how it works, with no "military-grade" nonsense.
Data Sovereignty Isn't a Map Pin: Why "EU Region" Is Not "EU Jurisdiction"
Servers in Frankfurt aren't sovereignty. Residency is geography; jurisdiction is power. The US CLOUD Act binds the company, not the disk — which is why Microsoft's own lawyer told the French Senate he "cannot guarantee" EU data stays in the EU.
Proton Drive vs Tresorit: An Honest Comparison (and a Third Option Worth Knowing)
Proton Drive and Tresorit are both genuinely zero-knowledge, so encryption won't decide it. Open-source scope, ownership and price will — here's the fair head-to-head, plus an EU, open-source-client third option.
Is Dropbox End-to-End Encrypted? Who Can Actually Read Your Files
Dropbox encrypts your files with AES-256 — but it holds the keys, so it can read them, hand them to a court, or lose them in a breach. Here's who can actually open your files.
End-to-End Encryption vs Encryption at Rest: Why "Encrypted" Doesn't Mean Private
"Encrypted at rest" protects your provider's datacenter from a stolen drive. It does nothing to keep the provider, a subpoena, or a breach out of your files. What actually decides whether your data is private is one thing: who holds the key.
S3 Storage Price Per TB in 2026: AWS vs Google vs Azure vs Backblaze vs Wasabi vs R2 vs Hetzner
Seven object stores, one sourced per-TB table dated May 2026 — AWS to Hetzner. Raw storage spreads almost 4×, but egress is the line that actually decides your bill.
Why we chose EU-only infrastructure
Our infrastructure runs on dedicated servers in Falkenstein, Germany — owned and operated by a European company. Here is why we avoided the hyperscalers.
What "Made in Europe" actually means
When we say "Made in Europe," we mean every byte, every server, every legal entity. Here is exactly what that entails.
How zero-knowledge encryption works at Beebeeb
A technical walkthrough of our encryption architecture: from passphrase to ciphertext, with no server-side key material.
Why we built Beebeeb
The cloud storage market is full of products that promise privacy but deliver convenience with a privacy veneer. We built Beebeeb because we wanted the real thing.
The US CLOUD Act, Explained for Europeans: How a US Warrant Reaches Your EU-Hosted Data
A US warrant doesn't cross the Atlantic — it just needs the company to be American. Here's exactly how the CLOUD Act reaches EU-hosted data, and the two things that put data beyond it.
The Best EU Alternatives to Dropbox in 2026: Encrypted, GDPR-Native, Stored in Falkenstein
Dropbox is a US company that holds your keys. Five real European providers don't — an honest profile of each, who they suit, and where they genuinely beat us.
Is iCloud Zero-Knowledge? What Advanced Data Protection Encrypts (and What It Doesn't)
iCloud isn't zero-knowledge by default. Advanced Data Protection is opt-in, off until you enable it, and even switched on it never encrypts Mail, Contacts, Calendar, or your file metadata. Here's exactly what Apple can still read.
What Is Zero-Knowledge Encryption? A Plain-Language Guide (and How to Tell If Your Cloud Has It)
"Encrypted" hides the only question that matters: who holds the key? Here's what zero-knowledge actually means, how the key gets made on your device, and a five-point checklist to test any provider's claim before you trust it.