Writing on privacy, encryption,
and building in Europe.
Technical deep-dives, infrastructure decisions, and honest takes on what it means to build software that genuinely respects your data.
How to Mount Encrypted Cloud Storage as a Drive in macOS Finder (and the macFUSE Catch in 2026)
Mounting an encrypted cloud as a Finder drive sounds simple until macFUSE asks you to drop your Mac to Reduced Security. Here's the rclone path, the kext-less FUSE-T and FSKit alternatives, and where beebeeb's bb webdav fits today.
ChaCha20-Poly1305 vs AES-256-GCM: Which Cipher Wins on Your Phone vs a Server?
Neither cipher is "stronger." AES-256-GCM flies on servers with AES-NI; ChaCha20-Poly1305 wins on phones and ARM boards without it, and is far harder to leak timing from. The honest, hardware-dependent answer, with XChaCha20's nonce as the sub-plot.
Why a Backblaze-Cheap Object Store Doesn't Make Your Files Private
A B2 bucket at ~$6/TB looks like a steal next to a personal cloud — until you notice the provider holds your keys, and that you'd have to build the encryption, sync, and sharing yourself.
The EU Tech Sovereignty Package, Explained: What the May 2026 Bundle Actually Changes
Four initiatives, one bundle, and headlines treating proposals as law. Here's what the May 2026 EU Tech Sovereignty Package actually binds, what it only suggests, and why "where your data sits" was never the real question.
How Zero-Knowledge Storage Survives a Provider Breach: What 2026's Bucket Leaks Couldn't Expose
In 2026's bucket leaks — Tabiq, Abu Dhabi Finance Week, the European Commission — attackers walked off with readable passports. A zero-knowledge host hands them ciphertext instead. Here's what that protects, and the metadata it honestly doesn't.
When Self-Hosting Beats the Hyperscalers (and When It Doesn't): An Honest Break-Even
Self-hosting object storage looks cheaper than S3 the instant you do the arithmetic. Then the line items nobody invoices — redundancy, power, your 2am pager — move the real break-even. Here's where each side actually wins.
What "Made in Europe" Should Mean for Cloud Storage — Beyond the Data-Center Map Pin
A German data center is residency, not sovereignty. Five questions separate a genuinely European provider from a US company with a Frankfurt region: who owns it, who can compel it, where the keys live, who the sub-processors are, and whether you can verify any of it.
GDPR Cloud Storage for Clinics, Law Firms and Accountants: A Practical Sovereignty Guide
If a foreign authority can compel your cloud provider, your client's confidential files are exposed and the GDPR liability is yours, not the vendor's. Here is what a defensible setup for a clinic, firm or practice actually requires.
HAProxy vs nginx for Load Balancing: An Honest, Use-Case-Driven Comparison
HAProxy grew from a load balancer; nginx grew from a web server. That origin gap decides most of the choice — and active health checks, free in HAProxy but paid in nginx, are where it gets real.
Lost Your Password to a Zero-Knowledge Account? What Recovery Actually Means
True zero-knowledge means no reset-password email can save you, only your recovery phrase can. Here's exactly what that tradeoff costs, and how to set recovery up so a forgotten password is a non-event instead of a disaster.
Falkenstein vs US-East: The Real Cost and Sovereignty Math for EU Teams
US-East looks cheaper per gigabyte until you read your data back at $0.09/GB. Storage in Falkenstein flips that math — and removes a CLOUD Act exposure no "EU region" of a US provider can.
Open source vs "trust us": how to verify a cloud storage privacy claim before you switch
A privacy claim you can't check is just marketing. Here's how to verify a cloud storage provider's encryption and "open source" claims yourself — with the Proton Lumo overclaim and the Mullvad raid as the cautionary and the proof.
How a Zero-Knowledge Backend Is Architected: Storing Data You Cannot Read
A zero-knowledge server only ever sees ciphertext, which quietly breaks search, dedup, and previews, and changes exactly what a breach can leak. Here's the full backend picture, and how to check a provider's claim is architectural, not marketing.
Why European Companies Are Leaving US Cloud Providers in 2026 — and What to Check Before You Do
European sovereign cloud spending jumps from $6.9B to $12.6B in 2026, and the Tech Sovereignty Package gave it a regulatory push. But a European flag on a pricing page is not jurisdiction. Here is what to actually check.
Collect Files From Clients Without an Account — and Without the Host Reading Them
Dropbox and OneDrive file requests let anyone upload without an account, but the host still holds the keys. Here's how to collect client files accountless and sealed to a key only you can open.
The True Cost of Cloud Storage: The Five Line Items the Per-GB Price Hides
Object storage advertises a low per-GB rate, then bills you for egress, requests, cold-tier retrieval, and replication on top. Here are the five meters behind a cloud bill — and why a flat per-TB price removes four of them.
Self-Hosting Nextcloud vs a Managed Zero-Knowledge Provider: The Honest Cost-and-Effort Breakdown
A small VPS costs a few euros a month. The real Nextcloud bill is your time, your backups, and your 2 a.m. on-call. A fair look at DIY sovereignty versus letting someone run the server while you keep the keys.
A Recovery Phrase for Your Files, Not Your Coins: How BIP39 Backs Up Encrypted Storage
The 12 words you'd write down for a crypto wallet do the same job in encrypted storage — they back up the master key that decrypts your files. Here's how BIP39 works, why Beebeeb uses it, and the honest catch: we can't recover it for you.
What an Encrypted Cloud Provider Can Actually Hand to the Police
A court order compels everything a zero-knowledge provider holds and nothing it doesn't. Here's exactly what's producible: account metadata yes, decryptable file contents no — because the keys never leave your device.
Anycast, DNS Failover, and Round-Robin: How Traffic Actually Finds a Healthy Server
Routing a user to a live backend isn't one decision — it's three stacked layers: anycast at the network, DNS failover at resolution, proxy health checks at the connection. Each fails differently, and the failures compound.
Can Your Cloud Provider Train AI on Your Files? Most Can. Here's the One Architecture That Can't
LinkedIn, Meta, and Atlassian all flipped stored content into AI training data by default. The only providers that structurally can't are the ones holding nothing but ciphertext.
The honest guide to leaving Google Drive, Dropbox, iCloud or OneDrive for an EU cloud
Pick a provider whose company — not just its servers — sits under EU jurisdiction, ideally zero-knowledge and open-source. Export your files, verify the copy, then bulk-move via CLI or WebDAV. You trade some integration convenience for real jurisdiction and no lock-in.
How to share a file with an expiring, password-protected link we can't read
Most "secure share links" are only secure from the public — the provider still holds the keys. Here's how to send a file with an expiring, password-protected link where the decryption key never touches our servers, plus max-opens and cryptographic revocation.
What Does 1 TB of Cloud Storage Actually Cost? Consumer Plans Compared Per TB
Flatten every plan to one number — cost per terabyte — and iCloud and Google win on raw price at about $5/TB. But the cheap number buys storage they can read, and that is a different product from one only you can decrypt.
Germany vs Switzerland for Privacy: The Jurisdiction Comparison Nobody Does Honestly
"Swiss privacy" is doing heavy lifting in 2026. With the VÜPF revision pushing IP retention and a decryption clause by decree — and Proton shipping servers to Germany — here's the honest legal comparison, including where Switzerland still wins.
Zero-knowledge storage, explained without the hype — and how to verify it yourself
Zero-knowledge cloud storage encrypts your files on your device before they upload, with keys only you hold. The provider stores ciphertext it can't read, scan, hand over in readable form, or train AI on. That's stronger than "encryption at rest", where the provider keeps the keys and can decrypt wh
Passkeys Explained: How Logging In Without a Password Actually Works
A passkey swaps your password for a key pair: the private half never leaves your device, so there is nothing to phish or leak in a breach. Here is what WebAuthn does under the hood, and why it beats a password.
Schrems II in 2026: Is Moving EU Data to a US Provider Still Legally Risky?
The Data Privacy Framework is still valid in 2026 — but a pending CJEU appeal, a PCLOB without a quorum, and a looming NOYB challenge make a US-provider setup a bet, not a settled question. Here's the honest TIA math.
Most Private Cloud Storage in 2026: How to Tell Real Zero-Knowledge From Marketing
Five questions cut through the "secure cloud storage" noise: where encryption happens, who holds the keys, whether the clients are open source, the jurisdiction, and whether the audit is real. Here's how the serious providers actually score.
NIS2 and DORA: What They Actually Require From Your Storage (a 2026 Checklist)
For storage, NIS2 (transposition deadline 17 October 2024; enforcement ramping) and DORA (in force since January 2025) demand five concrete things: state-of-the-art encryption with a written cryptographic policy, crypto-agility and post-quantum readiness, EU-resident keys you control, a register of
How to Encrypt Photos Before Uploading to the Cloud (Without a Separate Tool)
The usual advice is to staple Cryptomator or 7-Zip onto Google Photos and hope you never skip a step. Client-side-encrypted storage encrypts every photo on your device before upload by default, with no separate tool and no plaintext escape hatch.
How We Run PostgreSQL With Zero-Downtime Failover: Patroni, Explained From Scratch
A single Postgres node is a single point of failure. Here's the pattern that survives a database server dying mid-write — Patroni, a leader lease in etcd, streaming replication, automatic failover — explained from first principles, the way we run it.
OneDrive Alternative for EU Teams: Leaving Microsoft 365 Lock-In Without Losing GDPR Footing
Microsoft 365 is good software owned by a US company — and Microsoft's own lawyer told the French Senate, under oath, that he can't guarantee your data stays out of US hands. Here's how EU teams move the files that matter.
Is your cloud storage subject to the US CLOUD Act? A plain-English guide for EU businesses
If your cloud provider is a US company, the CLOUD Act reaches your data — even when it sits on servers in Frankfurt or Dublin. The 2018 law compels US firms to hand over data they control, anywhere on earth, on a valid US demand. EU servers and "sovereign cloud" branding don't change who can be comp
Your Password Never Leaves Your Device: How OPAQUE Logins Work
Most "secure" logins still hand your password to the server inside TLS, where a stray log or a compromised process can leak it. OPAQUE proves you know your password without ever transmitting it — here's the mechanism, honestly.
GDPR-Compliant Cloud Storage: What "Compliant" Actually Requires
There is no GDPR certificate. "Compliant" is a property of your processing, not a badge a vendor grants — and the badge stays silent about Article 28 DPAs, sub-processor lists, and US legal reach.
Is Google Drive Encrypted? Why Google Can Read Your Files (and How to Fix It)
Google Drive encrypts your files in transit and at rest, but Google holds the keys, scans your content, and can hand readable files to US authorities. Here's what that means and how zero-knowledge storage closes the gap.
Sovereignty Washing: Why a US "Sovereign Cloud" Still Isn't Sovereign
Sovereignty washing is selling a US-owned cloud as "sovereign" because it sits in an EU datacentre. It isn't. Jurisdiction follows the company, not the disk, so the US CLOUD Act still reaches the data. Real sovereignty needs EU ownership plus zero-knowledge encryption: the only claim that survives a
Egress Fees Are the Real Cloud Storage Bill: Why $23/TB Becomes $113/TB on AWS
S3 storage looks like $23/TB until you read it back at $0.09/GB and the bill hits $113/TB. Egress, not capacity, drives the cloud invoice — and the pricing page buries it in a footnote.
iCloud Storage Maxed Out at 12 TB? The Real Cost of Apple's Ceiling vs Scaling Past It
iCloud+ stops dead at 12 TB for €59.99/month, and there is no plan above it. Here's the real per-TB math, where Apple is genuinely cheaper, and when scaling past the ceiling is worth the move.
AES-256-GCM in Plain English: The Cipher That Locks and Tamper-Checks Your Files
AES-256-GCM doesn't just scramble your data — it produces an authentication tag, so altering one bit of ciphertext makes decryption fail instead of returning a corrupted file. Here's how it works, with no "military-grade" nonsense.
Data Sovereignty Isn't a Map Pin: Why "EU Region" Is Not "EU Jurisdiction"
Servers in Frankfurt aren't sovereignty. Residency is geography; jurisdiction is power. The US CLOUD Act binds the company, not the disk — which is why Microsoft's own lawyer told the French Senate he "cannot guarantee" EU data stays in the EU.
Proton Drive vs Tresorit: An Honest Comparison (and a Third Option Worth Knowing)
Proton Drive and Tresorit are both genuinely zero-knowledge, so encryption won't decide it. Open-source scope, ownership and price will — here's the fair head-to-head, plus an EU, open-source-client third option.
Is Dropbox End-to-End Encrypted? Who Can Actually Read Your Files
Dropbox encrypts your files with AES-256 — but it holds the keys, so it can read them, hand them to a court, or lose them in a breach. Here's who can actually open your files.
End-to-End Encryption vs Encryption at Rest: Why "Encrypted" Doesn't Mean Private
"Encrypted at rest" protects your provider's datacenter from a stolen drive. It does nothing to keep the provider, a subpoena, or a breach out of your files. What actually decides whether your data is private is one thing: who holds the key.
S3 Storage Price Per TB in 2026: AWS vs Google vs Azure vs Backblaze vs Wasabi vs R2 vs Hetzner
Seven object stores, one sourced per-TB table dated May 2026 — AWS to Hetzner. Raw storage spreads almost 4×, but egress is the line that actually decides your bill.
Why we chose EU-only infrastructure
Our infrastructure runs on dedicated servers in Falkenstein, Germany — owned and operated by a European company. Here is why we avoided the hyperscalers.
What "Made in Europe" actually means
When we say "Made in Europe," we mean every byte, every server, every legal entity. Here is exactly what that entails.
How zero-knowledge encryption works at Beebeeb
A technical walkthrough of our encryption architecture: from passphrase to ciphertext, with no server-side key material.
Why we built Beebeeb
The cloud storage market is full of products that promise privacy but deliver convenience with a privacy veneer. We built Beebeeb because we wanted the real thing.
The US CLOUD Act, Explained for Europeans: How a US Warrant Reaches Your EU-Hosted Data
A US warrant doesn't cross the Atlantic — it just needs the company to be American. Here's exactly how the CLOUD Act reaches EU-hosted data, and the two things that put data beyond it.
The Best EU Alternatives to Dropbox in 2026: Encrypted, GDPR-Native, Stored in Falkenstein
Dropbox is a US company that holds your keys. Five real European providers don't — an honest profile of each, who they suit, and where they genuinely beat us.
Is iCloud Zero-Knowledge? What Advanced Data Protection Encrypts (and What It Doesn't)
iCloud isn't zero-knowledge by default. Advanced Data Protection is opt-in, off until you enable it, and even switched on it never encrypts Mail, Contacts, Calendar, or your file metadata. Here's exactly what Apple can still read.
What Is Zero-Knowledge Encryption? A Plain-Language Guide (and How to Tell If Your Cloud Has It)
"Encrypted" hides the only question that matters: who holds the key? Here's what zero-knowledge actually means, how the key gets made on your device, and a five-point checklist to test any provider's claim before you trust it.