Security & privacy
Ours to keep safe. Never ours to keep.
Every file is encrypted at rest. Anything you put in your Vault is encrypted in your own browser, under a passphrase that never leaves it — so neither our storage provider nor we can open it. Not a promise: we do not have the key.
This page describes what FastDrive does today, not what we hope to do. Where something isn’t built yet, it says so.
Try sealing these three sample files.
- 01Your files
- 02Browser encryption
- 03Your Vault
Stored in the EU
Your files sit in Backblaze B2’s EU Central region, in the Netherlands. Nothing is stored outside EU jurisdiction.
Zero-knowledge Vault
Every file is encrypted at rest. Files in your Vault go further: they are encrypted in your browser before upload, names included, under a key we never receive. We store ciphertext and a locked key we cannot unlock. Lose the passphrase and the recovery code, and the files are gone — that is what makes it a vault.
Lock the Vault to your office
Pin your Vault to the internet addresses your business works from — the office line, a fixed VPN exit. Then a stolen passphrase is not enough on its own: it has to be used from somewhere you named. Enforced on our servers, not in the page, so it holds even if someone has your account.
Leave with everything
One click exports the whole drive as a zip, Vault included, built in your own browser — so it is never limited by what our servers can hold. Your files are ordinary files; there is no format to escape from.
Sign-in security
Files are only as safe as the account in front of them. Two things stand between a stolen password and your drive, and both are yours to switch on.
Security keys and passkeys
A YubiKey, or the passkey on your phone. The strongest second factor there is: nothing to type, nothing to phish. Add as many as you like under Settings → Security.
Authenticator app
Six-digit codes from Google Authenticator, 1Password or any app that does TOTP — with backup codes for the day the phone is lost.
See every sign-in
Every browser and device signed in to your account, with where and when. Sign one out, or everything except the one in your hand, from Devices and activity.
Told when something is new
An email the moment your account is used from a browser we have not seen, the desktop program is linked, or an app password is made. Not you? One link changes your password and signs everything out.
Plain answers to the questions people actually ask.
Can you read my files?
Ordinary files: we don’t, and support only sees names and sizes. Vault files: we can’t. They are encrypted in your browser with a key made from your passphrase, and the passphrase never leaves your machine. What we hold is scrambled data and a locked copy of the key that only your passphrase (or your recovery code) opens. There is no reset, no back door and nothing to hand over — if a court asked, we would be giving them noise. Apple offered this in the UK until February 2025 and had to withdraw it; Google, Microsoft and Dropbox do not offer it on a personal plan at all.
What is the Vault, and why isn’t everything in it?
The Vault is a folder whose files only your browser can decrypt. That has a cost: a Vault file can’t be handed to someone through a public share link (they would receive noise), previews and downloads pull the whole file through your browser, and if you lose both the passphrase and the recovery code, the files are gone for good. That is a fair trade for payroll, contracts and bank details, and a poor one for a folder of site photos you share every day — so you choose, per folder.
What if a government asks for them?
We will comply with a valid UK or EU order, and we will tell you unless we are legally prevented from doing so.
Where exactly are the servers?
Backblaze B2, EU Central region, in the Netherlands. We name it so you can check it against your own rules rather than take our word for the continent.
Is it backed up?
Partly, so here is the exact shape of it. Deleted files sit in a bin for 30 days before they are removed for good. Replace a file and the previous version is kept for 30 days on Essential and above. A folder can carry a retention rule — keep quotes a year, invoices six — and expired files go to the bin first, never straight to deletion. What we do not do is replicate your files to a second region ourselves: they are held durably by our storage provider in one EU region. FastDrive is storage, not a backup strategy on its own — if something matters to your business, keep a copy elsewhere too. That is true of every cloud drive, including the large ones; we would just rather say it.
Can I use a security key?
Yes. Add a FIDO2 key or a passkey under Settings → Security; an authenticator app works too. With either one, a stolen password on its own gets nobody in. And every sign-in from somewhere new is emailed to you, so you would know.
What happens if you close?
You would get 90 days’ notice and time to take everything with you. Nothing will lapse silently. That one is a commitment rather than a description — it is the only promise left on this page.