How are my files encrypted in Code Buckets?

Every file you upload is split into 16 MiB chunks, and each chunk is encrypted with AES-256-GCM before it's stored:

• Each bucket has its own 256-bit data key, created with the bucket.
• Every chunk gets a fresh random 96-bit nonce and is bound to its object and position, so chunks can't be swapped or replayed into another file without failing authentication.
• The bucket's data key is never stored in plain form: it's wrapped by a Clatter Labs master key that lives only in our servers' secret configuration and is never sent to clients, logged or kept with the data.
• Downloads are decrypted on the fly and verified; a tampered chunk fails instead of returning wrong bytes.

See Encryption.