Security at Bebra Labs

Security is not a feature we bolted on — it is the architecture. This page describes how we protect your data, and how you can verify it yourself.

Zero-knowledge encryption

Files are encrypted on your device with XChaCha20-Poly1305 before they leave it. Keys are derived from your workspace secret and wrapped per device. Our servers store ciphertext and encrypted metadata only. Even under subpoena, we cannot produce plaintext we do not have.

Infrastructure

• Tier IV data centers in Tallinn and Frankfurt, ISO 27001 certified
• TLS 1.3 everywhere; HSTS preloaded
• Encrypted backups with 35-day retention, tested quarterly
• Hardware security modules for root key custody

Compliance

Bebra Labs OÜ is SOC 2 Type II audited (report available under NDA on the Business plan) and fully GDPR-compliant. We act as a data processor; you remain the controller. Our DPA is countersigned automatically at signup.

Responsible disclosure

Found a vulnerability? Email security@bebralabs.io. We triage within 24 hours and credit researchers in our hall of fame. Please do not test against customer workspaces.

Uptime

Current platform status is published at status. Historical uptime for the trailing 12 months: 99.98%.