What client-side encryption changes

ZeroLatch encrypts files in the browser before upload, so storage contains ciphertext rather than the original file. That reduces plaintext exposure if storage is accessed.

Recovery mode still matters. Simple uses a server-managed recovery boundary, so ZeroLatch can technically recover content after the authorised release checks. Private requires a password or recovery phrase that ZeroLatch does not store. A legal request may also cover account, billing, recipient, operational, and encrypted storage records.

Trust the boundary you actually choose

Encryption is a control, not immunity from compromise or legal process. Review who can recover the key, how recipient access is verified, what metadata exists, and how your own devices and mailbox are protected.

Use Private when preventing ZeroLatch from recovering the content matters more than assisted recovery. Use Simple when a recoverable handoff is the more important requirement.

What a provider may still disclose

Depending on the service and applicable law, records may include account identifiers, recipient addresses, timestamps, billing details, access logs, support messages and ciphertext. A recipient's mailbox or device can also expose the recovered plaintext after delivery.

The right question is not “Can legal process be defeated?” No legitimate service can promise immunity from lawful requests. Ask which records exist, how long they are kept, what the selected recovery mode permits and whether the design has been independently reviewed.

Reduce exposure without making absolute claims

Minimise the payload, avoid unnecessary personal data, protect the account with strong authentication and keep the recipient's device in the threat model. In Private mode, preserve the recovery code through an independent tested route. In Simple mode, understand and accept the assisted-recovery boundary.

Obtain qualified legal advice for high-risk journalism, regulated data or cross-border matters. Encryption improves confidentiality; it does not determine whether creating, possessing or disclosing the content is lawful.