01 / 03
We cannot read your files.
Files are encrypted on your device with keys we never see. What lands on our servers is opaque ciphertext.
Security
Three things you
should know about us.
02 / 03
We cannot recover your password.
If you lose your password and your recovery phrase, your data is gone. By design — the alternative is a backdoor. Which we don’t offer.
03 / 03
We comply with EU law.
When legally compelled, we hand over what we have. What we have is ciphertext. Nothing decryptable.
This page describes what Beebeeb does, how, and where we draw the line. It does not describe what we hope to do. Last reviewed: 06 May 2026.
One file’s journey
Upload, in eight steps.
What happens between “drop file” and “file is stored”. The file is encrypted before it leaves your device. Your password is never sent anywhere — not even to us.
Your device
Wire
EU server
1 You sign in Your password authenticates you via OPAQUE PAKE. The password itself never leaves your device.
2 Master key unlocked Your master key lives on your device, encrypted at rest by your password. After inactivity, you re-enter it to unlock again.
3 Per-file key A unique 256-bit key is derived for this file via HKDF-SHA256 from your master key.
4 Encrypt with AES-256-GCM The file is encrypted on your device with a fresh random nonce. The result is ciphertext + an authentication tag.
ciphertext
6 Server stores opaque blob We receive ciphertext we cannot decrypt. The filename is replaced with a hash. Metadata we keep: size, timestamp, owner.
7 Stored in the EU Held in datacenters in Falkenstein, Germany, under EU law. Your data never leaves the EU.
8 Acknowledgement Server returns a content hash. Your client verifies the upload. Done.
The crypto stack
Every primitive, named.
No proprietary cryptography. No undisclosed algorithms. Standard primitives, chosen for known properties, used in standard ways.
Primitive
Role
Why this choice
Protects against
AES-256-GCM
Symmetric encryption
Authenticated encryption — protects confidentiality and integrity in one primitive. The standard choice; fastest path with hardware acceleration.
Server breach, in-transit observation
HKDF-SHA256
Key derivation (per file)
Derives a unique 256-bit per-file key from your master key, so a compromise of one file’s key reveals no others.
Cross-file leakage if a single file’s key were ever exposed
Argon2id
Password → master-key encryption
Memory-hard KDF. Even a determined attacker with your encrypted master key needs expensive hardware to brute-force the password.
Offline brute-force of stolen device data
OPAQUE PAKE
Authentication
Password-Authenticated Key Exchange. You authenticate to us without ever sending the password — we receive a proof, not the secret.
Server-side password leaks, MITM attempts
X25519
Per-recipient share encryption
When you share a file with another Beebeeb user, we re-encrypt the file key to their public key. They decrypt with their private key locally.
Server-side access to shared content
12-word BIP39
Master-key seed
A 12-word phrase generated locally at signup. Your master key is deterministically derived from it. The phrase, not the key, is what you back up — lose it and the master key cannot be regenerated.
Account recovery on password loss; portability across devices
TLS 1.3
Transport
Belt-and-braces. All client-server traffic is over TLS 1.3, even though the file payload is already encrypted before it gets there.
Network observers, downgrade attacks
Keys, password, recovery
Three things on your device.
Only one of them is ours to lose.
Read this section before you sign up. The recovery phrase is not optional.
Your 12-word phrase
on paper, ideallyA 12-word BIP39 mnemonic generated on your device at signup. Your master key is deterministically derived from this phrase — it is the root of all your encryption. We never see it. Lose this phrase and your password, and your data is gone.
word1 word2 ... word12 Your master key
derived, on deviceDeterministically derived from your 12-word phrase. Encrypts every file you ever store. Lives only on devices you’ve unlocked. Never transmitted in the clear.
derive_key(mnemonic) → 256-bit key Your password
in your headEncrypts your master key at rest on each device. After inactivity (default 30 min) we wipe the unlocked key from memory and re-prompt for the password. Easy to change — the master key stays the same.
argon2id(password, salt) → wrap-key What happens if you lose …
Recoverable
Just the password
You use the 12-word phrase to re-derive your master key on a new device and set a new password. No data lost.
Act fast
Just the 12-word phrase
Your data stays accessible on devices already unlocked. But: you cannot add new devices, and if you ever forget the password, recovery becomes impossible. Generate and back up a new phrase immediately from settings.
Permanent loss
Both
Your data is permanently inaccessible. We cannot help. By design — the alternative is a backdoor we could be forced to use.
Account security
Your login, locked down.
Encryption protects your files. These protect the account that holds them — available today.
Passkeys (WebAuthn)
Sign in with a passkey bound to your device or security key — nothing to phish, nothing to leak in a breach. There is no shared password for an attacker to steal.
WebAuthn · phishing-resistant
Two-factor authentication
Add a time-based one-time code from any authenticator app as a second factor. Even a stolen password on its own cannot open your account.
TOTP · authenticator apps
Password that never leaves your device
When you use a password, it is never sent to us. We authenticate you with the OPAQUE protocol — the server only ever sees a proof that you know it, never the password itself.
OPAQUE · password never sent
Threat model
What we protect against,
and what we don’t.
Every product has limits. We’d rather you know ours than discover them.
Server breach
An attacker who steals our database gets ciphertext. The keys to decrypt it never touch our servers.
Insider access at Beebeeb
No engineer, founder, or admin at Beebeeb can read your files. We don’t have the keys either.
Subpoena / legal compulsion
When legally compelled, we hand over what we have: ciphertext + metadata (size, timestamps, owner). Nothing decryptable.
Network observers
TLS 1.3 protects the connection; the payload is already encrypted client-side anyway.
Lost or stolen device
Your master key is encrypted at rest by your password and wiped from memory after inactivity. A thief gets nothing without the password.
Our hosting provider
Even if our hosting provider were fully compromised, they would see only ciphertext, the same as us.
Compromised device
If malware on your device steals your password and reads your files while they are decrypted in memory, that is outside our model. We protect you against the cloud, not against your own machine.
Lost password and lost recovery phrase
There is no backdoor. Both lost = data permanently inaccessible. This is the price of the guarantee.
Coerced password disclosure
If someone with a court order or a wrench compels you to type your password, we can’t help. The encryption is end-to-end; you are one of the ends.
Weak passwords
Argon2id slows down brute-force, but a six-character password is still a six-character password. Use a passphrase.
Sharing decisions
If you share a file with someone, they can read it and re-share its decrypted contents however they want. Nothing in cryptography fixes that.
Side-channel attacks on your hardware
Speculative execution exploits, evil-maid attacks, hardware keyloggers — we cannot defend against the device you are using.
Infrastructure
EU-based.
Today, and by design.
Where your encrypted data physically sits matters even when the data is ciphertext. Jurisdiction determines which laws govern any request for it.
Today
In production
Stored in Falkenstein, Germany
All ciphertext currently lives in datacenters in Falkenstein, Germany. German law applies — no data-retention mandate, and German law forbids handing data to foreign law enforcement. No data is replicated outside the EU.
In testing
Not yet live
Beebeeb-operated EU storage
We’re building our own storage fleet in EU datacenters. Because we value the trust customers place in us, we will only migrate to it after extensive redundancy testing and proven operational maturity. We will document the move when it happens.
Jurisdiction
EU law applies
Beebeeb is established in the Netherlands. Our processing is governed by the GDPR and Dutch implementing law. We do not transfer personal data to non-adequate jurisdictions.
Data we can see
Metadata only
Account email · billing details · file size · upload timestamp · owner · share recipients (when applicable). We see no filenames (those are encrypted), no file contents, and no folder structure beyond what’s required to render your file list.
Data we cannot see
Files, filenames, keys
File contents are AES-256-GCM ciphertext. Filenames are encrypted with the same per-file key. Your master key, your password, and your recovery phrase never reach us in any form.
Legal compulsion
What we’ll do when asked.
We don’t pretend to be above the law. We just made sure the law can’t extract what we don’t have.
We comply with valid legal requests from EU authorities. We do not comply with requests that lack a legal basis under EU law.
When we receive a valid request, we hand over what we have:
- Account email, billing records, and IP addresses we have logged
- Encrypted file blobs (ciphertext)
- Metadata: file sizes, timestamps, sharing relationships
- Encrypted filenames (ciphertext, not readable)
What we do not have, and therefore cannot hand over:
- Decrypted file contents
- Original filenames
- Your master key, password, or recovery phrase
- Any means by which we could decrypt the ciphertext
If we’re asked to add a backdoor:
we will refuse, contest it through every legal avenue, and — if
ultimately compelled — disclose it publicly to the extent the law allows.
No ongoing user can be silently downgraded.
Verifiability
Read the code yourself.
Every piece of software that handles your encryption keys is open source. If we said one thing on this page and shipped another, the code would show it.
core Rust Cryptographic core, shared types, sync engine github.com/beebeeb-io/core → web TypeScript Web client — encrypted file management in your browser github.com/beebeeb-io/web → cli Rust bb — your vault from the terminal github.com/beebeeb-io/cli →
How to verify a release
- Clone the repo at the commit SHA listed on the release page.
-
Read
core/src/— everything that touches your keys is in there. About 1,500 lines. - Build the client locally and compare its behaviour to what this page describes. The only data leaving your machine should be ciphertext, the wrapped per-file key, and OPAQUE protocol messages.
- Use a network proxy to confirm. We’d rather you verify than trust.
On audits: we have not yet had a third-party
cryptographic audit. Our clients are open source so anyone can review them today.
We will publish audit results here when we have them.
Responsible disclosure
Found something?
Tell us first.
If you’ve found a vulnerability in our clients, our protocol, or our infrastructure, we want to hear about it before anyone else does.
We’ll acknowledge within 48 hours and aim to resolve high-severity issues within 14 days. We will credit you publicly with your permission, on this page, when the fix ships.
For now, use the responsible disclosure mailbox. We will publish a fuller program policy when we can support it properly.
Security changelog
What changed, when, and why.
We log every security-relevant change here: cryptographic primitive upgrades, key-rotation events, post-mortems, and resolved disclosures.
Nothing to report yet.
When entries appear here, they will list the change, the date, the affected components, and the reasoning. This page exists so that changes are public, dated, and auditable.
Subscribe via RSS at beebeeb.io/security.rss — coming soon.
Common questions
Straight answers.
What is zero-knowledge encryption?
Zero-knowledge encryption means the provider cannot read your data. Your files are encrypted on your device with a key only you hold, before they ever reach the server. Beebeeb stores ciphertext and never receives the key — so we cannot decrypt your files, by design.
Can Beebeeb read my files?
No. Files are encrypted on your device with AES-256-GCM before upload, using a master key derived from your password and 12-word recovery phrase. We never receive that key, so we hold only ciphertext. No engineer, admin or founder at Beebeeb can read them.
What happens to my files if Beebeeb is breached?
A breach of our servers only exposes ciphertext and limited metadata — file size, timestamps, owner. The decryption keys never touch our infrastructure, so an attacker who steals the entire database still cannot read a single file.
What can Beebeeb hand over to law enforcement?
Only what we have: encrypted blobs we cannot decrypt, plus metadata such as your email, billing details, file sizes and timestamps. We cannot produce file contents or filenames, because they are encrypted with keys we never hold.
What if I lose my password and recovery phrase?
Your data becomes permanently inaccessible. There is no backdoor and no master key on our side — the recovery phrase is the master secret. We cannot reset it for you. That is the cost of encryption only you can unlock.
Encryption you can verify.
One email when we go live. Zero-knowledge from the first byte. Read the code, then decide.
Join the waitlist