CipherDrive™ encrypts supported file contents in your browser or client before ordinary encrypted storage. Ackaia's infrastructure stores encrypted file data, encrypted key material, and the operational metadata needed to run the service.
A typical supported upload works like this:
You select a file.
Where applicable, CipherDrive's Risk Assessment Engine performs disclosed pre-encryption safety checks.
Your client generates a random key specifically for that file.
Supported metadata, such as the filename where enabled, may be encrypted locally.
The file is divided into chunks when needed.
Each chunk is encrypted locally using AES-GCM and the file key.
The file key is wrapped using higher-level vault key material.
The encrypted chunks and encrypted key material are uploaded.
After client-side encryption has completed, Ackaia does not ordinarily need the plaintext file contents or the plaintext file key to store the object.
CipherDrive uses per-file keys rather than encrypting every file directly with one master key. This helps isolate files from each other and creates a more flexible foundation for sharing, key rotation, rewrapping, and selective access.
When you access a file, the process is reversed:
CipherDrive verifies the account, session, link, or permission.
The encrypted file data and encrypted key material are retrieved.
Your client uses available vault material to unwrap the file key.
The encrypted chunks are authenticated and decrypted locally.
Your client reconstructs the readable file.
If the required key material is unavailable, Ackaia may be technically unable to create a readable version of the file for you.
AES-GCM provides both confidentiality and integrity. In addition to hiding the plaintext, it is designed so that tampered or corrupted ciphertext fails authentication instead of being silently accepted as trusted data.
Zero-knowledge storage is not zero metadata. CipherDrive may still need information such as account identifiers, encrypted object size, timestamps, object type, folder relationships, sharing status, transfer usage, session information, and security or safety signals.
Client-side encryption moves an important part of the security boundary to your browser or device. Malware, a compromised operating system, a malicious extension, exposed local keys, or someone controlling an already-unlocked session can undermine confidentiality without breaking the server-side encryption model.
Key idea: CipherDrive is designed to reduce how much you must trust the storage provider, but your trusted device remains part of the system.