Ask which part of the service was compromised

A stolen database, a compromised running application and an infected recipient device are different incidents. Encryption can reduce what stolen stored content reveals, but it does not make every incident harmless. An attacker might also disrupt check-ins, alter instructions presented by the website, target an inbox or deny access. Assess confidentiality and availability separately.

ZeroLatch encrypts file contents in the browser before upload. That describes where encryption happens; it does not establish that the service has no recovery capability. The mode and the handling of its keys determine that boundary.

Simple and Private have different key custody

Simple allows an authorised application service to recover the content key. The current implementation wraps these keys using a server environment encryption key. A compromise involving both protected content and sufficient application secrets could therefore expose content. Migration to an independently managed key-management service is not complete.

Private requires a user-held password or ZeroLatch recovery phrase. Stored Private content remains encrypted and needs that secret to unwrap its content key. A weak or reused password may be guessed. Losing the secret can also prevent a legitimate recipient from opening the delivery; ZeroLatch cannot reset it. An algorithm name does not remove either risk.

Metadata and the browser remain part of the boundary

Account, recipient, billing and scheduling information can remain readable to the service. Do not interpret encryption of a file as encryption of every operational field. A person who compromises a browser, its extensions or the code it receives may capture information during creation or opening. Recipient email compromise is another risk that storage encryption alone cannot solve.

Keep devices updated, protect email accounts and preserve Private secrets through a separate agreed route. Use a scoped handoff so that a single package does not contain everything needed to control all of your accounts or assets.

What evidence is available today

The transparency notice records current limitations. No completed independent security audit is published there. Automated regression tests and internal code checks do not establish that the whole service is free of vulnerabilities. The status page reports a limited view of delivery processing, not independent monitoring of every dependency.

Keep original files and a separate usable backup. Follow the recovery checklist, practise with harmless content and avoid treating a successful demonstration as proof that every future release will succeed. Send vulnerability reports to security@zerolatch.com without including customer secrets or sensitive files.