A privacy claim you can't check is marketing
The only cloud storage claims worth anything are the ones you can verify without asking permission: read the client source, scope exactly what "encrypted" and "open source" actually cover, and find out who has audited the running system. Everything else is "trust us" wearing a privacy badge. Two recent cases show the gap. One provider got caught rounding "the clients are open" up to "fully open source." Another had its privacy claim tested by police, in public, and it held.
Step 1: read the client source, not the homepage
End-to-end encryption is a property of code, not a property of a pricing page. One narrow question decides whether a "zero-knowledge" claim is real: where does the encryption happen? If your files are encrypted on your device before upload, with keys derived from a passphrase that never leaves your machine, the provider physically cannot read them. If encryption happens server-side, the provider holds the keys, and "encrypted" buys you almost nothing against a subpoena or a breach.
You can only settle that by reading the client. Open the repository, find where the file bytes get encrypted, and confirm it happens before the network call. For Beebeeb that path is public — the web app, CLI, mobile, desktop, and the core crypto library are all open source, so you can trace a file from picker to ciphertext yourself. Data is AES-256-GCM. Keys come from Argon2id at 256 MB and 4 iterations. Sharing uses X25519; login uses OPAQUE so the server never sees your password; keys are zeroized from memory after use. None of that is something you have to believe. It's something you can read.
Step 2: scope the claim — open source what?
"Open source" is the most abused phrase in the privacy market, because it's almost always true of something and rarely true of everything. The skill is asking: open source which part, exactly?
In July 2025, Proton launched its AI assistant Lumo with the homepage line "Unlike other AI assistants, my code is fully open source." It wasn't. The only published code was the mobile and web apps. The models, the architecture, and the routing system that actually process your prompts stayed closed. The European Open Source AI Index called it "the least open 'open' AI assistant," and Proton's own support later described full open source as a "long-term intention, not the instantaneous state." This is a company that is genuinely good on privacy. That's the point: even a strong privacy company will round its clients up to "fully open source" if nobody scopes the claim for them.
So scope it. For cloud storage, the part that matters is the client, because that's where encryption and key handling live. A closed server that only ever receives ciphertext can't read your files no matter what its source looks like.
Here is Beebeeb's scope, stated plainly so you don't have to guess: the product clients are open source — web, CLI, mobile, desktop, and the core crypto. The server is private, and so is this marketing site. The reason isn't flattering, it's honest. The server stores ciphertext and routes it; the security guarantee lives entirely in the client code you can already read. Opening the server would let you audit nothing you can't audit today, while exposing operational and abuse-mitigation logic. We'd rather say "the clients are open, the server is not, here's why" than let you assume more than is true. To check scopes side by side, read our honest Beebeeb vs Proton Drive comparison — Proton's storage clients are open source and publicly audited too, and we match them on that ground rather than pretend otherwise.
Step 3: check who tested the claim — and what fell out
Source code tells you what software intends to do. It doesn't tell you whether the running system leaks, or what happens when someone with a warrant shows up. For that you want independent audits with published findings, and ideally a real-world test under pressure.
Mullvad is the reference case for both. In April 2023, Swedish police arrived at its Gothenburg office with a search warrant, intending to seize computers holding customer data. They left with nothing, because no such data existed to seize. The no-logs claim wasn't proven by a blog post; it was proven by a raid that came up empty. On top of that, Mullvad publishes its audits. Cure53 ran a fourth infrastructure audit in June 2024 — two issues, one low, one medium, neither touching the core product. Assured Security Consultants ran a web-app penetration test in August 2025 and found no critical, high, or medium issues. You can read both reports. That's what a verifiable posture looks like: a claim, an independent test, and the findings in public, good and bad.
Beebeeb is a younger product, and I won't pretend otherwise. We have not been audited yet. An independent audit is planned, and when it happens the findings get published in full, including anything unflattering. Until then the honest line is "open clients you can read today, audit pending" — not "audited." If a provider's site says "audited" with no report attached and no auditor named, treat it as unverified.
The three-minute checklist
Before you move a single gigabyte, run this on any provider:
- Where does encryption happen? Find it in the client source. Client-side before upload, or it isn't zero-knowledge.
- Open source which parts? Clients, server, or "a repo exists somewhere"? Name them. A closed server holding only ciphertext is fine; a closed client is not.
- Who derives the keys? You, from a passphrase that never leaves your device — or the provider?
- Who audited it, and where's the report? A named auditor and a published PDF, or nothing.
- What does the provider concede? Honest limits stated up front beat a flawless pitch every time.
Most mainstream services fail the first question outright. Dropbox, Google Drive, and iCloud encrypt in transit and at rest but hold the keys, so they aren't zero-knowledge by default — they can read your files, and so can anyone who compels them. iCloud is cheaper than us at the small tiers, which is a real edge if price is your only axis. It just isn't the same product.
Beebeeb's clients are public, the crypto is documented, and the scope is stated without rounding up. Our security page walks the full key-derivation chain, and the roadmap tracks the planned audit and the native mobile and desktop apps. Want to test the habit on us first?