Security & privacy

treesync is built so that we can’t read your code. Your files are encrypted on your own device before they’re ever uploaded, and only your devices can decrypt them.

End-to-end encryption, always on

There’s nothing to enable. In practice:

• Files are encrypted on your machine before anything leaves it.
• They’re stored encrypted in the cloud; only your devices hold the key.
• This includes secrets — a .env file is encrypted just like everything else.

Encryption uses modern, well-established cryptography. You don’t configure any of it.

Recovery codes

Your encryption is tied to a key only your devices have. So you’re never locked out if you lose all of them, treesync gives you recovery codes at first sign-in.

What we can and can’t see

We can see — the minimum needed to run sync:

• Your account info (e.g. email) and which devices you’ve registered.
• That synced data exists and how much — storage and bandwidth totals for your plan.
• Encrypted blobs and the bookkeeping to keep your devices in sync.

We can’t see:

• The contents of your files — encrypted with a key we don’t have.
• Your file names and folder structure — these travel inside the encrypted data, not as plaintext we can browse.

In short: we can tell that you’re syncing and how much, but not what.

Per-device identity

Each device you sign in gets its own identity and public key. That lets you see your devices and (in an upcoming release) revoke any one individually — say, a lost laptop — without affecting the others.

Good practices

• Keep your recovery codes safe and separate from your devices.
• Sign out of devices you no longer use: treesync logout.
• Keep treesync up to date for the latest fixes — see Upgrading.

Questions

For a security question or to report a vulnerability, contact security@treesync.dev.