Skip to content

Transparency Report

Last updated: April 28, 2026

What We Can't Do

These properties are enforced by the design of the system, not by policy. They hold regardless of any legal order, internal decision, or compromise of our infrastructure.

  • We never see your data. File contents are encrypted client-side before leaving your device. Plaintext never reaches our infrastructure.
  • We never hold your keys. Encryption keys are derived client-side and are never transmitted to or stored by us.
  • Your data never passes through us. Encrypted data flows directly between the client SDK and Sia storage hosts. Our infrastructure is not in the data path.
  • We can't read your metadata. Object metadata is encrypted client-side before being pinned to the indexer. We store it, but it's opaque to us.
  • We can't tamper with your metadata. Object metadata is signed client-side with a key derived from your secret. Any modification causes a verification failure when the client SDK retrieves the object.
  • Everything is open source. The client SDKs, the indexer, and the full storage stack are publicly auditable.

What We Hold

In the interest of transparency, this is the complete list of user data our infrastructure stores or has access to:

  • Account information — email address, payment and billing details
  • Encrypted object metadata — opaque to us, client-signed, tamper-evident
  • Object sizes

We do not hold file contents, plaintext metadata, encryption keys, API access logs, or IP address logs.

Some Things We've Never Done

The following statements are true as of the date listed above. If a statement is removed in a future update, it should be interpreted as no longer being true. This page is updated on a quarterly cadence; if the page is not updated within 90 days of the last update date, it should be treated as potentially stale.

We have never:

  • Received a National Security Letter
  • Received a FISA court order or directive
  • Received any government request accompanied by a gag order
  • Been compelled to implement additional logging, data collection, or surveillance capabilities beyond what is described above
  • Provided any user data to a government agency or third party
  • Received a request for real-time monitoring of any user