File upload architecture
How Clav protects your files, with secure storage by default and optional zero-knowledge encryption.
Two security levels
The platform offers two storage modes, chosen per organisation, to meet different compliance requirements.
Standard mode
Secure storage with AWS-managed encryption. The server can read the file, which is what makes features like preview and AI-assisted validation possible.
Zero-knowledge mode (optional)
End-to-end encryption. Not even platform administrators can access the contents of your files.
Which one to choose
We recommend standard mode, because it enables the AI validation that automatically checks whether your compliance files are filled in correctly. If you need to store highly confidential information, turn on zero-knowledge mode, which gives maximum privacy but disables that validation.
What the server actually stores
In zero-knowledge mode, every layer is stored encrypted. This table summarises what exists on the server and what would be needed to open each item:
| Item | How it is stored | Readable by the server? |
|---|---|---|
| File in S3 | Encrypted with AES-256-GCM | No, needs the file key |
| File key | Encrypted with the TMK | No, needs the TMK |
| Organisation TMK | Encrypted with each user’s public key | No, needs the user’s private key |
| User private key | Encrypted with the password | No, needs the password |
| User password | Never stored | Does not exist on the server |
| User public key | Plain text | Yes, and it is not secret |
That chain is what backs the claim that a full server compromise does not hand over file contents.
Rotating the organisation key
Owners can run a TMK rotation, which generates a new master key and re-wraps every member, integration and file key onto it.
The rotation runs in the browser of an administrator who already holds the current TMK, so the server never sees plaintext key material. The previous generation is kept in a 7-day recovery window, so an aborted or incorrect rotation can be reverted; after that it is purged. Each rotation is locked to its own token, so stale clients cannot write into a rotation that has already been superseded.
Compliance
LGPD
Strong encryption of sensitive personal data, access minimisation, and a complete audit trail.
GDPR
Permanent deletion, data minimisation (the server holds no plaintext), and privacy by design.
NIST CSF
Encryption at rest and in transit, identity and access management, and continuous monitoring through logs.
Benefits
For the organisation: security that holds even against a server compromise, protection from insider threat, complete audit records, automatic versioning, and control over who has access, revocable at any time.
For the people using it: encryption happens automatically, with no keys to manage by hand, and the interface is the same as a service without encryption. The algorithms are industry standards, auditable and based on public specifications.
Frequently asked questions
Does encryption slow uploads and downloads down?
The impact is minimal. Encryption happens in the browser with hardware acceleration (AES-NI on modern processors). For files up to 100 MB the difference is imperceptible; for larger files it may add a few seconds.
What happens if I lose my password?
Since your password is the only way to decrypt your private key, you would lose access to the files encrypted under it. That is why we recommend a trustworthy password manager. An administrator can re-wrap the TMK onto a new key of yours, so you do not lose access to the organisation’s files.
Can you recover my files if I forget my password?
No. That is the essence of zero-knowledge: not even we can access your files without your password. An organisation administrator can grant access again through TMK re-wrapping, but your old private key stays inaccessible.
Can encryption be turned off after it is enabled?
We do not recommend it, but it is technically possible. New uploads stop being encrypted, files already encrypted stay encrypted, and you have to decide whether to decrypt and re-upload the old ones.
How do I know encryption is working?
Every envelope carries an explicit format-version field, and readers reject unknown versions. Audit records log key operations and rotations. And you can inspect the raw data in S3: it will be unreadable.
Can I share files with people outside the organisation?
Encrypted files are only reachable by members who hold the wrapped TMK. To share externally, add the person as a member of the organisation, or download and send the decrypted file by another route.
Does encryption protect file metadata?
Partly. Content is fully protected, but some metadata stays visible: file name, size, upload date, MIME type and who uploaded it. That is needed for basic features such as search and sorting. If you need full metadata protection, talk to us.
What is performance like with many encrypted files?
Listing and searching are unaffected, because those operations use only the metadata, which is not encrypted. Decryption only happens when you download or view a file.