Question 1

Where are my credentials stored?

Accepted Answer

In your browser's IndexedDB, encrypted with AES-GCM. The key is derived from your passphrase with PBKDF2-SHA-256 (210,000 iterations) and is never sent anywhere.

Question 2

Do my files pass through your servers?

Accepted Answer

No. There is no application backend. Your browser talks directly to Amazon S3, Cloudflare R2, Google Cloud Storage, Azure or Cloudinary.

Question 3

Which storage providers are supported?

Accepted Answer

Amazon S3, any S3-compatible service (Cloudflare R2, MinIO, Backblaze B2, Wasabi and others), Google Cloud Storage, Azure Blob Storage and Cloudinary.

Question 4

Why do I need to set up CORS on my bucket?

Accepted Answer

Because requests come straight from your browser, the bucket has to allow this site's origin. The Add connection dialog shows a ready-to-paste CORS policy for each provider.

Question 5

What happens if I forget my passphrase?

Accepted Answer

The vault can't be decrypted without it, so you'd delete the vault and add your connections again. Your files in the cloud are not affected.