CircleKey Cloud — pricing for the zero-knowledge backend

What it actually does

Four responsibilities. Everything else — encryption, key management, membership authorisation — happens on your users’ devices, where we cannot reach it.

Stores encrypted records

Ciphertext in, ciphertext out, byte for byte. We never parse, transform or inspect it, because there is nothing in it we could read.

Keeps vault history in order

Membership changes are append-only and strictly sequential. We guarantee that two conflicting changes can never both be accepted — the one concurrency guarantee the protocol asks a backend for.

Rejects stale writes

A write tagged with an out-of-date vault version is refused. This is why a removed member’s queued write cannot land after their removal.

Pushes changes in real time

Clients get told when a vault changes instead of polling for it — on every plan, at no extra cost. Offline clients catch up on reconnect.

Straight answers

What we can and cannot see.

You are about to trust a vendor with your users’ data. You should know precisely what that vendor holds. Here is the split, field by field — and if something you consider sensitive appears on the left, put it inside the encrypted record instead.

◐ Visible to us, in plaintext

The vault’s identifier and its version counter
What kind of change happened — a join, a removal, a role change
The member list: user identifiers, device public keys, and who the managers are
The vault’s governance policy
Which device signed each change, and its signature
Record identifiers, sizes and timestamps
The salt and parameters attached to a recovery backup

● Never received by us at all

Any plaintext your users write, of any kind
Any vault key, present or historical
Any per-record encryption key
Any device private key
Any user’s recovery credential
The contents of a sealed key envelope
Anything that would let us decrypt, forge or join

And the ordinary operational truth: beyond the fields above we hold what any hosted service holds — your billing account, and the IP addresses, user agents and timings in our request logs, which we keep for 30 days. We are also a single point of availability: a service that is down or throttled cannot serve your users. We cannot read or forge anything, because clients verify everything themselves — but downtime is a genuine thing we can do to you. That is exactly why the export and the build-your-own route below are not decoration.

Pricing

Cheap, because it should be.

This service stores opaque blobs and enforces two ordering rules. It runs on elastic infrastructure that costs us cents. Pricing it like an enterprise security product would be a tax on doing the right thing, so we don’t. Every plan includes a 14-day free trial.

All prices in USD, billed monthly. Cancel any time; your ciphertext is exportable on every plan.
	Starter $5 /mo	Growth $19 /mo	Scale $59 /mo
Best for	Shipping your first encrypted feature	A product with real users on it	Growth, or a compliance conversation
Active vaults	25	250	2,000
Monthly active users	100	1,000	10,000
Stored ciphertext	5 GB	50 GB	250 GB
Egress	25 GB / mo	250 GB / mo	1 TB / mo
Overage	$0.10 per GB stored · $0.05 per GB egress — the same on every plan, no penalty rate
Real-time sync	Included	Included	Included
Re-keying & devices	Unlimited	Unlimited	Unlimited
Region	EU or US	EU or US	Your choice, pinned
Uptime target	—	99.9%	99.9%
Ciphertext export	Self-serve	Self-serve	Self-serve
Support	Email	Email, one business day	Priority, plus DPA and subprocessor list
	Start trial	Start trial	Start trial

Bigger than Scale, or need the data somewhere specific? Mail us and we will quote against your actual numbers rather than a tier you have to grow into.

What we deliberately don’t charge for.

Metering shapes behaviour. These three are metered by plenty of vendors, and every one of those meters pushes a customer towards the less safe choice.

Re-keying is free and unlimited

Every membership change mints a new vault key. Charging per change would put a price on the single mechanism that makes the product secure. We are not going to invoice you for good hygiene.

Devices are free and unlimited

People work on a laptop and a phone, and mandatory backup is the only safe route out of losing one. Billing per device taxes exactly the behaviour we want. We bill per user, not per keypair.

There is no “encryption tier”

Every plan gets identical cryptography, because encryption happens on your users’ devices and we could not sell it back to you if we wanted to. Money buys capacity, region choice, and a contract — never security.

The other door

Build your own backend instead.

CircleKey is a front-end library that talks to storage through one interface. We publish that interface and we do not hold a privileged position behind it. If you would rather run it yourself — or need to, for procurement reasons — here is the whole job.

A short list of operations

Create a vault, read its current state, submit and fetch membership changes, optionally subscribe to them, put and get and list records, and store one recovery blob per user. Any wire format you like — REST, GraphQL, WebSocket, whatever your stack already speaks.

A handful of rules

Keep membership history append-only and strictly unique per version. Reject writes tagged with a stale version. Store the opaque fields byte-for-byte without parsing them. Gate access on the membership list. That is the complete set of guarantees the client depends on.

An executable acceptance test

runHostIntegrationScenario from circlekey/testing drives your implementation through the whole client-observable contract and names the exact assertion that failed. You are not guessing whether you got it right.

Export is a ciphertext dump

Records, membership history and recovery blobs are bytes we cannot interpret anyway. Move them to another host and clients re-verify the whole chain from scratch against the new one — the history does not know or care who served it.

We would rather win the customers who stay because operating this is boring than the ones who stay because leaving is hard. The backend interface, in detail →

Questions we get asked

Can you read our data?: No. We never receive plaintext, vault keys or private keys — they are not part of any request the client makes. We can see everything in the left-hand column above, which is a real amount of metadata, so read it rather than take our word for the headline.
Could you add yourselves to a vault?: No. Adding a member requires a signature from a device that already held the authority to do it, and we hold no such key. Every client checks that signature and the chain it sits in before accepting anything, so a forged change is rejected everywhere at once.
Could you lock us out?: Yes — availability is the one thing a hosted service genuinely controls. We can’t read or forge, but we can fail. That is why every plan can export its ciphertext at any time and why the backend interface is public.
Has this been independently audited?: Not yet. No third party has reviewed the library or this service. When one has, we will publish the report in full, findings included.
Do we have to use CircleKey Cloud to use CircleKey?: No. The library is Apache-2.0 and works against any backend that implements the interface, including one you write. We sell convenience, not a lock.
What happens the moment we remove a member?: The vault re-keys and they receive no copy of the new key, so everything written afterwards is unreadable to them. What they had already downloaded stays on their device — no protocol can reach into a machine you don’t control and delete it, and we would distrust anyone who claimed otherwise.
Where is the data stored?: On Google Cloud, in the region you pick — EU or US on Starter and Growth, any supported region pinned on Scale. Encrypted at rest by the provider on top of the encryption your users’ devices already applied.

Start with the trial. Keep the exit.

Fourteen days, no commitment, and an export button that works from day one. Tell us roughly what you are building and we will get you a key.

Start free trial Read the docs