Encrypt Before You Upload

Nearly every cloud storage provider will tell you your files are encrypted. That is true, and it is a smaller promise than it sounds. It usually means the provider encrypts your data once it arrives and holds the keys, so the files are protected from someone who steals a hard drive out of a data center and from nobody who can log into an account.

Encrypting before upload is a different claim. It means the file is scrambled on your Mac, and what leaves your machine is already unreadable to everyone downstream, including the provider. The gap between those two sentences is the whole subject of this post, along with what the second one costs you.

Two different threats

Provider-side encryption and client-side encryption protect against different things, and it helps to name them plainly.

• Provider-side encryption protects the hardware. If a disk leaves the building, if a backup tape is lost, if a decommissioned drive is not wiped, your data is not readable. This is genuinely worth having and it is the default nearly everywhere.
• Client-side encryption protects against access. A stolen access key, a misconfigured bucket that got made public, an employee at the provider with more permissions than they need, a legal request served on the provider, an account compromised by a reused password. In each of those the attacker reaches your actual files, and provider-side encryption does not help, because the system hands them decrypted data by design.

The short version: provider-side encryption assumes the provider is trustworthy and the attacker is outside. Client-side encryption removes the assumption. If you encrypt before upload, the worst case for a breached bucket is that someone has a pile of scrambled bytes.

Note the ordering matters as much as the math. The same algorithm applied in the same way protects you differently depending on where the key lives. Encryption performed by the party you are worried about is not protection from that party.

Filenames are data too

The detail people underestimate is names. A folder listing is often more revealing than the files inside it.

Imagine a bucket where the contents are unreadable but the structure is not. Someone browsing it sees 2026-Q3-layoff-list.xlsx, or a client's company name on a folder of pitch materials, or merger-diligence, or a folder named after a person that contains medical paperwork. You have not leaked a single byte of file content and you have still leaked the thing that mattered. Structure is information.

This is why file-by-file encryption that leaves names in the clear is only half a solution. Orbit's encrypted folder uses rclone crypt, and it encrypts both file contents and file names on your Mac before anything reaches the storage provider. What your provider's console shows is a directory of gibberish.

What encrypting first actually costs you

This is where honesty matters more than enthusiasm, because client-side encryption is a real tradeoff, not a free upgrade.

• The provider can no longer do anything useful with your files. Web console previews, thumbnails, search inside documents, server-side processing. All of it depends on the provider being able to read the file. Take that away and those features go with it, by definition.
• Losing the password means losing the files. There is no reset link and no support ticket that fixes this. In Orbit you choose a vault password and can have this Mac's Keychain remember it, but if you lose both the password and that Keychain copy, the encrypted files cannot be recovered. That is not a policy we could soften. It is what the design means.
• Some metadata still shows. Approximate file sizes and modification times remain visible. Someone who can see the bucket can still tell that a 4 GB object arrived on Tuesday night, and in some situations the pattern of activity is itself a signal.
• The decrypted view is still a real file on a real Mac. When you open the vault, you get a readable view on your machine. Files you open there may be cached locally by macOS or by the apps you open them in. Encryption at rest in the cloud does nothing about a laptop left open at a coffee shop. Turn on FileVault.
• Sharing gets more manual. Anyone who needs the shared encrypted folder needs the original vault password, delivered to them somehow, and now that password is a thing you have to manage. Orbit does not handle team accounts or key distribution for you.
• It does not travel offline. In Orbit, offline folders work from the regular cloud drive. Encrypted vaults require a connection.

So which folders are worth it

Encrypting everything is a common instinct and usually the wrong call. You pay the costs above on every file while the benefit only applies to a small number of them, and the friction pushes people toward keeping unencrypted side copies, which is worse than not encrypting at all.

A better filter is to ask one question per folder: if this exact folder were readable by a stranger tomorrow, what happens? If the answer is a shrug, leave it on the regular drive. If the answer involves a phone call to a client, a lawyer, or an employee, encrypt it.

In practice the list is short and predictable. Anything covered by a confidentiality agreement or a specific obligation to a client. Employee records, compensation, anything from an HR conversation. Financial and tax documents with account numbers in them. Legal files, contracts under negotiation, anything about an acquisition or a dispute. Credentials, recovery codes, and infrastructure documentation, on the strong assumption that they should not be in files at all but sometimes are. Original creative work or source material that is the business itself rather than a deliverable.

What generally does not need it: project working files, marketing assets, finished deliverables the client already has, reference material, and anything you would email without thinking twice. Those benefit far more from previews and fast access than from secrecy.

The takeaway

Client-side encryption is not a stronger version of what your provider already does. It is a different arrangement of trust, where you keep the key and therefore keep the responsibility. It protects you from the failures that actually happen to small teams, which are access failures and configuration mistakes, not stolen hardware.

The price is that some things stop working and one mistake is unrecoverable. That is a reasonable trade for the folder that would cost you a client, and a bad trade for the folder of logo exports. Decide folder by folder, write down where the password lives, and keep a backup of anything you cannot afford to lose twice.