Skip to main content
This page describes technical properties and known limitations. It is not a certification statement, a legal opinion, or a substitute for a signed agreement. Formal compliance documentation is provided through the enterprise process.

​
Technical properties you can rely on

These are implemented behaviors, verifiable in the platform’s operation:

​
What storage-layer protection means

Files are encrypted by the application layer before they reach Everabyte’s storage infrastructure, and the infrastructure applies its own encryption at rest. The per-file key envelopes are held by the application services, and decryption runs inside authorized operations and controlled maintenance workflows. If your requirement is framed as “the storage layer must not be able to read our data”, that is satisfied. If it is framed as “no Everabyte service may ever process decrypted content”, that is not this architecture: authorized operations and platform maintenance workflows process decrypted content by design. State the requirement plainly in your review rather than assuming it away.

​
Data subject requests

Because files are encrypted and recoverable within authorized operations, deletion and export requests are technically executable:
  • Export: files can be downloaded through the API or dashboard, subject to the requesting user’s permissions.
  • Deletion: hard delete removes the object. Soft delete keeps bytes in trash for the configured window, which also means bytes remain billable until purge.
  • Retention: bucket and file retention settings can prevent immediate deletion by design. Treat retention as a policy you have chosen, not as a deletion failure.
Plan retention settings before you make deletion promises to data subjects.

​
Audit and evidence

Audit entries are recorded as a tamper-evident hash chain. Audit data can be exported from the dashboard by users with the compliance management permission. The developer REST API does not expose an audit export endpoint; if you need programmatic export beyond that, raise it during onboarding.

​
Known limitations to disclose in your own review

  1. Zero-knowledge assurance is not provided. Decryption happens within authorized operations and controlled maintenance workflows.
  2. No automatic cross-region redundancy. One region per object.
  3. No published RTO/RPO for standard plans.
  4. CDN delivery is opt-in (enterprise plans) and serves decrypted content at the edge, over signed URLs valid from 5 minutes to 30 days (6 hours by default), with edge caches holding objects for up to 30 days.
  5. Soft delete retains bytes until the trash window elapses or a hard delete is performed.
  6. Trial accounts have reduced limits and reduced feature access, notably MCP and compliance features.

​
Shared responsibility

​
Requesting formal documentation

For security questionnaires, DPAs, subprocessor lists, and certification evidence, contact support@everabyte.com or raise the request during enterprise onboarding. Bring specifics:
  • the jurisdictions involved,
  • the data categories you store,
  • your retention obligations,
  • any certification your customer requires,
  • whether CDN delivery is acceptable.
Vague requests produce vague answers. Concrete requirements can be answered concretely.

Encryption architecture

The technical model in detail.

Access control

Scopes, bucket ceilings, and step-up.

Data residency

Location binding and its limits.

Enterprise onboarding

Contractual and compliance conversations.