Look at the recovery path

A privacy claim needs a defined scope. Client-side encryption tells you where an operation occurs; zero-knowledge claims concern what a provider can learn or recover within a stated threat model. Ask whether the provider has a wrapped key it can unwrap, whether a recipient receives a separate secret, and which account or operational fields remain readable. A product can protect file contents while retaining metadata necessary to run the service. Neither a label nor an algorithm name establishes the privacy of the entire system.

The current ZeroLatch design

ZeroLatch offers two explicit recovery choices. Simple encrypts files in the browser and stores a wrapped content key recoverable by the service through the authorised flow. The current wrapping key is held in the server environment, rather than an independent managed KMS. Private protects a random delivery key using a password or generated ZeroLatch recovery phrase. The password route and generated-phrase route use different derivation steps; neither should be reduced to the claim that all files use a password-derived key directly. The security page describes the current public boundary.

Content, metadata and software are separate concerns

Private encrypts the payload, including messages, filenames and file types. The service still handles recipient addresses, schedules, ciphertext sizes and processing state. Devices, email providers, application delivery, storage and account access remain part of the risk assessment. Independent review should examine those connections as well as the encryption code. ZeroLatch does not represent an independent security audit or managed KMS migration as complete. Read the service continuity and backup guidance before deciding what information is appropriate to entrust to the service.

Turn the architecture into a usable plan

List the material your recipient needs, how they will verify their mailbox, and where any separate Private secret will be kept. Test the steps using synthetic information across devices. Record which backup remains available if the online service is unavailable. Review the plan when people, addresses or responsibilities change. A technically protected file is not useful if the intended person cannot find the instructions or secret. The free checklist helps prepare those decisions without submitting personal information or pretending that a demonstration completes a real rehearsal.