How your files are protected.
What exists today and what does not, plainly.
Today
- Files encrypted at rest
- Each account isolated
- HTTPS everywhere
- Two-step sign-in
- Passkeys and recovery codes
- Security emails
- Signed, notarized Mac app
Not yet
- End-to-end encryption (coming soon, optional)
- A second copy at another provider
- File version history
Two-step sign-in
Code from the authenticator app
Use a passkeyTouch ID, Face ID or a security key
Use a recovery code
End-to-end encryption Coming soon
Contents and names encrypted on your Mac, with a key only you hold.
Where your files are
Contents are at Backblaze B2, in the United States, encrypted at rest and stored under random IDs. Names and the folder tree are in the Nimbo database.
How bytes travel
Your Mac and browser talk straight to storage over HTTPS, with short-lived signed links for your own files only. The storage key never leaves the server.
Accounts and links are isolated
Another account gets “not found”, never a hint. Shared links reach only what they point to, use long random addresses, and stop at once when expired or revoked.
Your account
Passwords are stored as a slow hash. Two-step codes work once and wrong tries are limited. You get an email when your security settings change.
The Mac app
It signs in through the browser, so your password never enters it, and keeps its token in the Keychain. Signed with Developer ID, notarized, and it only accepts signed updates.
Who can see your files
No other user, except through links you create.
Until end-to-end encryption ships, the service holds the storage keys, so the operator could technically open your files. We do not, and the admin panel never shows contents.
What you can do
- Turn on two-step sign-in and save the recovery codes.
- Add a passkey on the Mac and on your phone.
- Use a password and an expiry date on sensitive links.
- Keep another copy of what you cannot lose.
Found a problem?
Write to nimbo@lumahost.com. Please do not test on other people’s accounts. We answer every report.