Ordinary uploads
The Zas browser, native apps, and local coding agent encrypt content before uploading it. The database and object storage hold encrypted content. A separate key service derives account keys from verified identity. An operator controlling that service with the relevant identifiers could reconstruct keys. Zas does not call this end-to-end encryption.Hosted ChatGPT and Claude connections
When you approve hosted AI access, a private Zas service holds encrypted connection keys. It decrypts authorized reads for the AI provider and encrypts content the app sends to Zas. Plaintext is processed during these operations. Your browser does not need to remain open. This access is limited by selected channels, Read/Send grants, connection expiry, and current organization policy. Read AI privacy and permissions for the full data flow and how to disconnect.Local coding agents
A local coding agent encrypts on the machine where it runs and receives keys only for granted channels. Its connection does not give it your account key. This differs from hosted AI access.Share links and metadata
A public share link carries a key in the fragment after#, which a normal HTTP request does not send to the server. Anyone with the complete link can open the shared item.
Encryption does not hide every relationship: the service processes account, channel, size, expiry, and operational metadata. Older storage can recognize repeated encrypted blocks. See privacy and the privacy policy.