Where your ciphertext actually lives
SEES stores sealed blobs on Storj and holds no database. What that means for what an operator can see.
There is no table with your name in it.
SEES has no user database, because it has no users in the usual sense — no email, no account record, no profile. A Vault ID is a locator for an encrypted object, not an identity. There is nothing to join it against.
Sealed blobs on Storj.
Encrypted blobs are written to Storj, an S3-compatible distributed storage network, where they are split and spread across independent nodes. Those nodes hold fragments of data they have no key for. SEES speaks to storage the same way any S3 client would, which is also why self-hosting works against any S3-compatible bucket.
What an operator can still see.
Encryption hides contents, not the existence of objects. Whoever runs the storage can see that a vault exists, roughly how large it is, and when it was last written. That is metadata, and we would rather name it than let "zero-knowledge" imply it away.
What they cannot do is read it. Decryption requires a key derived from a passphrase that never left your device.
MIT-licensed, no database to provision.
If you would rather not take our word for any of this, the full source is public and the deployment needs nothing but an S3-compatible bucket.
Read the self-hosting guide