Security · 2026-07-20 · 8 min read
There is a sentence on nearly every storage provider’s security page: your files are encrypted in transit and at rest. It is almost always true. It is also almost always compatible with the provider being able to read every file you own. Both things at once. That gap — between a claim that is technically accurate and a protection that actually applies to you — is where most people misjudge how exposed they are.
The fix is not to become a cryptographer. It is to learn to ask one question and know what the answers look like.
The four things the word can mean
| The claim | What it protects against | Who holds the keys | Can the provider read your files? |
|---|---|---|---|
| In transit (TLS) | Someone watching the network | Nobody, it is temporary | Yes — once it arrives |
| At rest (server-side) | Someone stealing the physical disks | The provider | Yes |
| End-to-end | The provider, insiders, a breach | You | No |
| Zero-knowledge | The same, and it extends to metadata | You | No, and they see less about you |
Encryption in transit means nobody can read your file as it crosses the internet. Encryption at rest means the disks in the data centre are encrypted, so a stolen drive is useless. Both are genuinely necessary. Neither of them prevents the provider’s own systems — or anyone who compromises them, or anyone who compels them — from reading your content, because the provider holds the key and the service needs the plaintext to do things like generate thumbnails or search inside your documents.
End-to-end encryption is the different one. The file is encrypted on your device, with a key derived from something only you have, and the provider receives ciphertext it cannot open. That is the point at which “encrypted” starts protecting you from the provider rather than merely from strangers.
How to check a claim in about two minutes
- Look for a password recovery flow. If they can restore access to your files after you forget your password, they hold a key. That is not a scandal — it is a deliberate usability trade — but it settles the question.
- Look at search and previews. Full-text search across your documents, or server-generated thumbnails of your photos, require the plaintext. Client-side search of a small index is different; read carefully.
- Look for the phrase “we cannot recover your data if you lose your key”. Providers who mean it say it loudly, because it is the honest consequence of real end-to-end encryption.
- Look for an audit or open-source clients. A claim you can inspect is worth more than a claim you are asked to believe.
- Look at what is encrypted. Sometimes file contents are, but filenames, folder structure and sharing metadata are not — and those leak a surprising amount.
If losing your password cannot lose your files, then someone other than you can open your files. Both cannot be true at once.
The option most people overlook: encrypt it yourself
There is a third path that gets far less attention than it deserves, and it works with any storage on earth. You encrypt the file on your own machine, and upload the resulting ciphertext. Now the storage layer is just a place that holds bytes, its security claims stop mattering very much, and you can switch providers without renegotiating your trust in anyone. The tools are mature and free, and the workflow takes about a minute once set up — we walk through it, including the key-management part people usually skip, in How to Store Sensitive Documents Safely.
The cost is real and worth stating: you lose previews, search and easy sharing, and if you lose the key the data is gone permanently. For your working documents that is a bad trade. For the twenty files that would genuinely hurt to have exposed, it is the strongest protection available to a normal person, and it does not require trusting a single vendor claim.
Where we stand, plainly
Walrus Drive does not encrypt your files for you, and we would rather say that in the first sentence than bury it. It is an interface to a public storage network: your file is erasure-coded across independent operators and certified on the Sui blockchain, and anyone holding the resulting blob identifier can retrieve those bytes. What the network guarantees is that the data stays available and verifiably intact without depending on any company — see Features for the specifics. Confidentiality is a separate layer, and it is yours to add.
That combination is actually a clean one. Encrypt locally, then store the ciphertext on a network that no company can suspend, price out or shut down. You get confidentiality from a key only you hold, and durability from a network with no single point of failure — and neither guarantee depends on a provider staying honest or staying in business. If you want to see the storage side of that in practice, the dashboard will store a file for you in a couple of minutes, no account required.