Security, in plain language
Every file is encrypted in your browser before upload. Simple and Private use the same file encryption; the difference is who can provide recovery.
Your recipient verifies their email address and does not need a separate secret.
Who can recover: ZeroLatch can technically recover the key after the authorised release checks pass. Simple is not zero-knowledge.
You create a private password or generate a 24-word ZeroLatch recovery phrase. ZeroLatch never stores it.
Who can recover: only someone with your secret. If it is lost, neither your recipient nor ZeroLatch can recover the files.
Encryption reduces the risk of stored files being read without authorization; it does not make any online service invulnerable. Email verification proves control of the intended mailbox for that access, not someone's legal identity.
Confirm the address now or keep it private until delivery. A new one-time email code is required before private details are shown.
ZeroLatch asks you to check in before any safety period can complete.
Release links are random, purpose-specific, stored as hashes, and expire.
For recipients
The first page reveals no sender, message, delivery name, or files.
Request and enter the one-time code sent to the intended address.
See the sender-provided name, message, and instructions after verification.
Simple needs no separate secret. Private asks for the password or recovery phrase the sender arranged separately.
Files use AES-256-GCM authenticated encryption in the browser. Stored file objects are ciphertext.
Simple deliveries store a wrapped content key protected by a server environment encryption key. This is not an independently operated KMS, and a managed KMS migration and independent security audit are not represented as complete. A consumed one-time release token, verified recipient session, and correct delivery mode are required before the key can be requested.
Private deliveries wrap a random delivery key with either a user-created password or a browser-generated 24-word ZeroLatch recovery phrase. The secret itself is not stored by ZeroLatch.
Private payload content, including messages, filenames and MIME types, is encrypted in the browser. Ciphertext size, recipient address, schedule and operational status remain observable metadata.
Database, application, email, device, and storage compromise are different risks. Use Private when preventing ZeroLatch from recovering the content matters more than avoiding a separate secret.