Where encryption happens

With server-side encryption, a service encrypts content after it reaches the server. With client-side encryption, a device encrypts it before upload. These describe the location of an operation. Neither term alone answers who can recover the key or what happens when a device is compromised. Ask for the actual data path: which content is encrypted, where keys are created, how they are stored, and how an intended recipient gets access. A diagram of that path is more useful than a blanket claim that one label is always safer.

Who can recover the content

Key custody is a separate design choice. A service-managed recovery path can reduce the burden on a recipient while giving the provider a technical recovery capability. A user-held secret can limit provider recovery while making loss of that secret consequential. Neither arrangement removes the need for reliable software, protected devices and a workable backup. Compare the risks that matter in the actual handoff: losing the secret, losing mailbox access, exposing a device, or depending on an unavailable online service.

The choices in ZeroLatch

Both ZeroLatch access modes encrypt files in the browser. Simple lets ZeroLatch provide the file key through the authorised recipient process after release. Private protects the delivery key with a separately held password or generated ZeroLatch phrase that the service does not store. Private also encrypts its payload content and file metadata. Account and operational metadata still exist. The public security page and recovery explanation describe these boundaries and the current limits of the service; the modes should not be presented as identical custody arrangements.

Verify the whole journey

Start with a harmless file and compare the received content with the original. Check the intended mailbox, the release timing and the access expiry. For Private, test the separate secret on the recipient device too. Keep original documents outside the service. Do not interpret a successful sample animation as evidence that a real upload, email or decryption succeeded. Browser cryptography provides operations rather than a complete security design; MDN explains the Web Crypto primitives and their limits. Select the arrangement that your recipient can understand and your actual recovery process can support.