Encryption and security
How files are encrypted, who can read them and keeping keys safe.
- Are uploads and downloads protected in transit?Yes. All API, Console and public link traffic uses HTTPS (TLS). Add X-Content-SHA256 to chunks to verify integrity.FAQ
- Can Clatter Labs employees read my code?Files are encrypted at rest with per-bucket keys managed by Clatter Labs' servers, and access is restricted. See the Privacy Policy.FAQ
- Can I use my own encryption key for a bucket?No. Each bucket's key is created and managed by Code Buckets. To control the key yourself, encrypt files before uploading.FAQ
- How are my files encrypted in Code Buckets?Each 16 MiB chunk is encrypted with AES-256-GCM using the bucket's own 256-bit key, which is itself wrapped by a Clatter Labs master key.Explainer
- How do I report a security issue in Code Buckets?Email infrastructure@clatterlabs.xyz or support@clatterlabs.com with details and steps to reproduce. Don't include working keys.How-to
- How do I store files that only I can decrypt?Encrypt files on your side before uploading (for example with age or GPG), upload them as assets, and keep your key safe yourself.How-to
- How quickly does revoking a key stop access to my buckets?Revoking a key in the Console stops it from working with Code Buckets within 30 seconds.How-to
- How should I store sensitive or proprietary code?Use a private bucket with preview off, a key with minimal permissions, never make files public, and consider encrypting before upload.How-to
- I uploaded a zip that contains passwords or API keys. What should I do?Rotate the exposed secrets first, delete the object, check it isn't public, and deal with any backup that still covers it.Troubleshooting
- Is Code Buckets suitable for regulated or confidential data?It encrypts files at rest with per-bucket keys and uses HTTPS. Review the Privacy Policy and Terms, and contact us about specific requirements.FAQ
- What stops someone tampering with my stored files?AES-256-GCM authenticates every chunk and binds it to its object and position, so tampered or swapped chunks fail to decrypt.FAQ
- What's encrypted, and how, in Code Buckets?A summary of protection for uploaded files, the preview tree, metadata, public files and traffic.Reference
- Who can read the files in my buckets?Only requests with a valid API key and the matching Account ID, or your signed-in Console session, plus anyone with a link to a file you made public.FAQ
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.