We are opening a design partner program. See the program
PRICING
The property: storage your own cloud cannot read, lose, or silently alter. One annual subscription, scoped to what you protect. You keep your providers and your own storage rates.
OPEN NOW
5 places
Open now, by application. One real use case, for the full duration of the program.
Custom
Billed annually, scoped to what you protect. Never by the gigabyte.
No form farms. A human reads every message.
WHAT IS INCLUDED
Protection is structural. It comes from the architecture, so it is identical in both columns and it is never a paid upgrade. What a contract scopes is how much of it you can demonstrate to someone who has no reason to trust you.
| Capability | Design partner program | Subscription |
|---|---|---|
| Structural protection | ||
| Your provider never receives a readable byte: encryption happens before upload | Included | Included |
| One provider breached or unavailable exposes fragments, not files | Included | Included |
| An operator served with a request can produce only incomplete fragments of ciphertext | Included | Included |
| What you can demonstrate | ||
| Proof of integrity a third party checks on a public registry, without calling you | Included | Included |
| Warning that a fragment is gone, before the day you need the file | Planned | Planned |
| Placement confined to the jurisdictions your contracts name, with the report to match | Planned | Planned |
| How we work together | ||
| TypeScript SDK and public docs | Included | Included |
| Onboarding run with you | Included | Included |
| Direct line to the engineering team | Included | Included |
| Influence on the roadmap | Included | Not included |
| Term | Six to eight weeks | Annual |
Your provider never receives a readable byte: encryption happens before upload
One provider breached or unavailable exposes fragments, not files
An operator served with a request can produce only incomplete fragments of ciphertext
Proof of integrity a third party checks on a public registry, without calling you
Warning that a fragment is gone, before the day you need the file
Placement confined to the jurisdictions your contracts name, with the report to match
TypeScript SDK and public docs
Onboarding run with you
Direct line to the engineering team
Influence on the roadmap
Term
Planned Specified and on the build path, not shipped yet.
QUESTIONS
Size is not the filter. What we look for is a real use case with a deadline, a named engineer who can spend time on it, and files you already keep on object storage. A team of five with a specific problem teaches us more than a large account with nobody to own it.
The integration is measured in hours: the SDK drops into the upload path you already have. The time that counts is the deciding, which files, which providers, how much redundancy. Plan for one named engineer, a few hours a week, for the length of the program. Not a project team.
Nothing moves, because nothing sits with us. Fragments stay in your own provider accounts, under your own contracts. The key is derived from a secret you hold, and we never receive it. The index describing a file is anchored on a public registry that anyone can fetch. Rebuilding a file takes your key, your provider credentials and the format, and the format is documented: none of the three depends on us still being here.
Not today. You connect your own provider accounts, so you keep the contracts and the rates you negotiated, and what you pay us covers only the layer above them: the pipeline, the proof, and the people you talk to. A managed option, where we supply the storage and put every provider on one invoice, is on the build path.
The program does, and nothing else. Your files stay where they are and stay readable with your key, whether you continue or not. Continue, and you carry a preferential rate into the subscription. Stop, and there is nothing to migrate and nothing to switch off. What the layer itself covers is set out in what the property covers.
