Your Documents.Your Keys.Zero Knowledge.
End-to-end encrypted document vault where even we cannot read your data. Upload, share, and manage sensitive files with zero-knowledge architecture.
Zero-knowledge in three steps
Your documents are encrypted before they ever leave your device. We engineer trust through mathematics, not promises.
Client-Side Lock
Files are encrypted in your browser using AES-256-GCM before upload. Your master key is derived locally via Argon2id and never transmitted.
Granular Control
Share documents with time-limited, revocable links. Set view limits, expiration, and permissions. Revoke access at any time.
Developer First
Integrate zero-knowledge encryption into your application with our TypeScript SDK. Full API documentation and webhook support.
Built for every workflow
From encrypted uploads to secure sharing — designed for the way modern teams handle sensitive documents.
Trust No One. Not even us.
CoffreZero is designed so that we mathematically cannot access your data. Our servers only ever see encrypted blobs.
Your Device
CoffreZero Servers
Built for Developers
Integrate zero-knowledge document encryption with our TypeScript SDK. Encrypt on the client, store on the server, share with anyone.
import { CoffreZero } from '@coffrezero/sdk';
const vault = new CoffreZero({
apiKey: process.env.CZ_API_KEY,
region: 'us-east-1',
});
// Encrypt & upload — keys never leave client
const doc = await vault.documents.upload({
file: userFile,
metadata: {
label: 'KYC Verification',
tags: ['identity', 'sensitive'],
},
});
// Generate time-limited share link
const link = await vault.shares.create({
documentId: doc.id,
expiresIn: '24h',
maxViews: 3,
permissions: ['view'],
});
console.log(link.url);{
"id": "doc_8xKp2mNq7Yz",
"status": "encrypted",
"encryption": {
"algorithm": "AES-256-GCM",
"kdf": "Argon2id",
"keyWrapping": "XSalsa20-Poly1305"
},
"share": {
"token": "sh_Tn4vXqWr9Bk",
"url": "https://coffrezero.io/s/sh_Tn4vXqWr9Bk",
"expiresAt": "2025-01-16T12:00:00Z",
"maxViews": 3,
"viewCount": 0,
"permissions": ["view"]
},
"createdAt": "2025-01-15T12:00:00Z",
"size": 2457600
}Secure by Design
Purpose-built for industries where document security is not optional.
KYC & Identity
Securely collect and verify identity documents with zero-knowledge proofs.
Legal Compliance
Protect privileged documents with tamper-evident audit trails.
Healthcare
HIPAA-ready encrypted document storage for medical records and patient data.
Financial Services
Bank-grade encryption for financial statements, tax documents, and transaction records.
Burn After Reading
Share secrets that self-destruct after one view. No account required.
Built on principles, not promises
Your privacy, our priority.
Secure Share Tiers
Three tiers of sharing — from link-based access to full zero-knowledge key exchange. Tier 2 seals the document key with the recipient's public key. We never see the plaintext. Ever.
Invisible Watermarks &
Immutable Audit Trail
Every shared document carries an invisible forensic watermark tied to the recipient's identity. Combined with a tamper-proof audit log that records every access, share, and modification.
Data Sovereignty &
Erasure Protocol
GDPR Article 17 compliance through cryptographic erasure. When you delete, we don't just remove the pointer — we destroy the encryption keys, making recovery mathematically impossible.
Burn After Reading
Share secrets that self-destruct after a single view. Set TTL timers, optional passwords, and view-once locks. Once read, the ciphertext and keys are permanently erased from all systems.
Developer API &
Webhook Engine
Full REST API with scoped API keys, HMAC-SHA256 signed webhooks, and automatic retry with exponential backoff. Build encrypted document workflows into any system.
Ready to take control of your documents?
Start encrypting your sensitive documents today. Free tier available with no credit card required.