Why we left zero-knowledge behind

For most of KinSwitch's life, we described it as zero-knowledge. In 2026 we stopped. This is the honest story of why: what zero-knowledge actually gave you, why it quietly worked against the one promise this product exists to keep, and what protects your data now.

What does "zero-knowledge" really mean?

In a true zero-knowledge system, your data is encrypted in your browser with a key derived from your password, and that key never leaves your device. The server stores nothing but ciphertext. We, the people who built KinSwitch, literally cannot read your files. Not with a subpoena, not with a database dump, not if we wanted to.

It sounds like the strongest possible promise. For a lot of products, it is.

What problem did it create for KinSwitch?

KinSwitch isn't a place to hide files. It's a promise that your things reach your people: that if you stop checking in, the documents, notes, and messages you chose are delivered to the family and beneficiaries you named.

Zero-knowledge and that promise are in direct tension.

If only you hold the key, then the moment you're gone, so is the only thing that can decrypt your vault. Your beneficiary receives a pile of encrypted noise and no way to open it. The single most important day in this product's life (the handoff) is exactly the day zero-knowledge fails the people it was supposed to protect.

And it wasn't only the edge case. Zero-knowledge's everyday trade-off (forget your password and everything is gone, forever, with no recovery) turned out to be the biggest real-world risk in the whole system. Not hackers. Not us. A forgotten password. For non-technical beneficiaries the fragility was worse: any hiccup in the key handoff meant they got nothing, at the worst possible moment.

Zero-knowledge also made the product noticeably worse to use. Because the server only ever saw ciphertext, we couldn't offer:

• Password reset: a lockout was permanent.
• Real search across your library.
• Instant previews: PDFs, images, and documents opening inline.
• Reliable delivery to beneficiaries who aren't cryptographers.
• The AI connector and other features that need to work with your content.

We were shipping a weaker, more fragile product and calling the weakness a feature.

What protects your data now?

KinSwitch encrypts everything (content and metadata) in a dedicated encryption vault, both while stored and while it moves. The keys are held server-side. This is the same model your email provider and your cloud storage already use, and we chose it deliberately.

That one change is what makes the rest possible: you can reset your password, search your whole library, preview files instantly, connect the AI features, and (most importantly) know that the people you named will actually receive what you left them.

What is the honest boundary?

We're not going to dress this up, because the whole point of this post is to be straight with you.

What we gave up: in a true zero-knowledge system, a full compromise of our infrastructure, or a court order compelling us, could not reach your content, because we didn't hold the keys. Under the new model, in that specific scenario, it could.

What you keep: a database breach alone does not expose your data. Content and metadata are encrypted at rest, so stolen database tables are ciphertext. Sharing is still always explicit and revocable. And nothing you store is ever one forgotten password away from being lost.

For the threat most people actually face (a breach, a leak, a lost laptop, a grieving family that needs access) this model is stronger, not weaker. For the narrow threat of a fully compromised provider or a subpoena, zero-knowledge was stronger, and we won't pretend otherwise.

What if you were here for the zero-knowledge era?

Your existing content is still yours and still encrypted. When you next unlock your vault, KinSwitch converts your old zero-knowledge items in your browser (decrypting them with your password and re-protecting them under the new model) through the "upgrade your vault" flow. Until you convert, those legacy items are listed but can't be read server-side.

Is the promise underneath the same?

We didn't change what KinSwitch is for. We changed the machinery so it can actually keep its promise: your digital life, protected and organized while you're here, and delivered to the right people when you're not, without a forgotten password standing between your family and the things you left them.

That's the trade we made, in the open. We think it's the right one.

FAQ

Why did KinSwitch leave zero-knowledge?

Zero-knowledge conflicted with the promise that documents reach beneficiaries if you stop checking in. If only you hold the key, the handoff fails. A forgotten password also made permanent data loss the biggest real-world risk.

Is KinSwitch zero-knowledge now?

No. As of 2026 KinSwitch encrypts everything, with keys held server-side. That change was deliberate.

What features became possible after leaving zero-knowledge?

Password reset, real search, instant previews, more reliable beneficiary delivery, and AI connector features that need to work with content. Those were not possible when the server only saw ciphertext.

What security tradeoff did KinSwitch accept?

In a true zero-knowledge system, a full infrastructure compromise or court order could not reach content because KinSwitch did not hold keys. Under the new model, in that specific scenario, it could. A database breach alone still leaves stolen tables as ciphertext.

What happens to old zero-knowledge vault items?

They remain yours and encrypted. On unlock, KinSwitch can convert them through the "upgrade your vault" flow. Until conversion, legacy items are listed but can't be read server-side.

Does a forgotten password still destroy the vault forever?

Not under the current model. Password reset is available. Permanent, unrecoverable lockout was a zero-knowledge-era tradeoff KinSwitch left behind.