Use Cloud Service Providers With Encryption

Keep using your preferred cloud storage while Cipher Nota encrypts files before they leave your control.

Keep the cloud. Keep the keys.

Own-cloud encryption lets you keep existing providers such as Google Drive, Dropbox, OneDrive, S3-compatible storage and business object stores while reducing how much those providers can read. Cipher Nota encrypts selected files before upload, so the storage provider receives ciphertext instead of the original document.

This is different from relying only on a provider's default encryption at rest. Default cloud encryption protects disks and infrastructure, but client-side encryption protects the content before the provider receives it.

View Plans
Encrypted files synced to cloud providers
Select files Choose the folders, documents or workspaces that need protection.
Encrypt locally Files are encrypted before they are uploaded or shared.
Store anywhere Use your preferred cloud provider while keeping readable content under your control.

Why encrypt before upload?

Major cloud platforms support strong storage security, but their own documentation makes a clear distinction between server-side encryption and client-side encryption. With client-side encryption, data is protected before it reaches the storage service.

  • AWS describes client-side encryption as encrypting data locally before sending it to Amazon S3.
  • Google Cloud describes client-side encryption as data arriving at Cloud Storage already encrypted.
  • Azure Blob Storage client libraries support encrypting data in the client application before upload.

Cipher Nota uses that same security idea as a product workflow: users keep provider choice, but files are protected before the provider becomes the custodian.

What the provider can still do

Encryption does not replace cloud storage. Your provider still supplies durability, availability, sync, bandwidth, object storage APIs, access logs and account billing. The change is that ordinary stored file content is no longer provider-readable without the user-controlled keys.

  • Providers can store, replicate and return encrypted files.
  • Providers may still see operational metadata such as object size, upload time and account activity.
  • Users remain responsible for key recovery, access hygiene and choosing trusted storage accounts.

How this supports zero trust

NIST's zero trust guidance focuses protection on resources rather than trusting a network location by default. Own-cloud encryption follows the same practical direction: every file should carry protection with it, even when it moves between devices, accounts or storage platforms.

  • Protect the file before it crosses a provider boundary.
  • Grant access explicitly instead of assuming the storage account is the trust boundary.
  • Revoke sharing and AI workspace access without exposing the whole storage account.

Good use cases

  • Personal vaults stored in Google Drive, Dropbox or OneDrive.
  • Team folders that need encrypted sharing and expiry controls.
  • Backups that should remain unreadable to the storage provider.
  • S3-compatible storage used as durable encrypted object storage.
  • Private AI workspaces limited to selected encrypted files.
  • Compliance workflows that need stronger key separation.

Sources