"Store your documents in the cloud" — that sentence sounds convenient, but it makes many people uneasy. Cloud means: somewhere, on servers run by someone else. Where exactly? Who can read along? What happens if the provider has a problem?
That's why at DocNado we deliberately speak of a cloud vault instead of "the cloud". The difference isn't just a word — it describes a different security model. In this article we'll explain what a cloud vault is, how the encryption behind it works, and the honest trade-off you're making.
The short definition
A cloud vault is an encrypted online archive that only you can open — not the provider, not their administrators, not someone who physically steals the servers.
The formula:
- Cloud = accessible from anywhere, on all your devices, immune to lost or broken phones.
- Vault = the contents are encrypted; the key exists only with you.
Together they create something a pure hard drive can't do (location-independent, failure-proof) and a pure cloud can't do (suspiciously secure).
Regular cloud
Cloud vault
How encryption works — without the math scare
Imagine writing a letter in a language only you and one other person understand. Even if the mail carrier reads it, nothing is revealed. Encryption is exactly that — except the "language" is a mathematical procedure.
Symmetric encryption: one key for locking and unlocking
With AES (Advanced Encryption Standard) — the algorithm used by banks and governments worldwide — there is one key. The key encrypts the document, and the very same key decrypts it. It all happens in 256-bit blocks — hence the name AES-256.
That's why the decisive question for any encryption scheme is not "Can the code be cracked?" but "Who has the key?". With today's technology AES-256 is considered practically unbreakable — a brute-force attack on a single key would take billions of years. The realistic point of attack is always the key itself: whoever holds it gets in. Whoever doesn't, doesn't.
Which leads straight to the core of the cloud vault.
How big is the keyspace? AES-256 has 2²⁵⁶ possible keys. That's a number with 78 digits — more than the estimated number of atoms in the observable universe (which sounds close at ~80 digits, but every doubling halves an attacker's chance). A single computer couldn't try a meaningful fraction of them within the lifetime of the universe. That's why real attackers never assault the keyspace — they attack the human in front of it: passwords that are too short, or keys lying around unprotected. A long, unique password (or a password manager) is therefore the single most important lever for your security — more than any technically superior encryption.
Zero knowledge: the provider doesn't know your key
With the big cloud drives, the rule often looks like this: you upload your file, and the provider encrypts it on their servers. Convenient — because if you forget your password, the provider can reset it for you. The catch: the provider (or anyone who gains access to their systems) can technically read your data.
A cloud vault built on the zero-knowledge principle flips this around:
- On your device, your personal key is derived from your password.
- Your document is encrypted before upload — what travels toward the server is already ciphertext.
- The server stores only the encrypted blob. Not even DocNado can read your documents — nobody but you holds the key.
"Zero knowledge" means literally that: the provider has zero knowledge of your contents. It's not a promise you'd have to believe — it's the technical construction.
Your document's journey
- 1Password
opens the vault key every day - 2Key derivation
happens on your device - 3AES-256
encrypts before anything uploads - 4Server stores ▓▓▓
unreadable ciphertext — done
Emergency route: the 12-word recovery phrase opens the same vault — independently of the password.
Password, passphrase, and the honest rest
Here's the part many providers downplay or hide in the fine print. With DocNado there are two keys, and the difference is worth understanding:
Your password is the everyday key. You sign in with it, and it derives the key that opens your vault.
The recovery phrase is the emergency key. During setup you're shown 12 words exactly once (a so-called BIP-39 phrase, the same concept hardware wallets use). Write them down and keep them safe. Both keys open the same vault door, independently of each other.
Three honest rules follow:
- Forgot your password? Not a disaster. The regular "reset password" link via email first resets only your login — the vault stays locked (a good thing: anyone with access to your inbox shouldn't be able to open the vault). After signing in, you enter your 12 words once, and DocNado moves the vault over to your new password. Everything works as before.
- Lost password and phrase? Now the vault is permanently closed. It's not us making that rule — the math makes it. Anyone who could recreate the vault key from your secret (namely, us) could also open your vault. That's precisely what we deliberately can't do.
- Phrase in the wrong hands? Whoever has your 12 words can move the vault to a new password. Keep it separate from your password — not as a note right next to your login, and not in the same leaked password-manager entry. A piece of paper in a safe place is the classic, good solution.
What this means in practice, and how to protect yourself sensibly:
- Use a password manager. One strong password, written down once, never typed by hand again — that solves 95 percent of the problem.
- Store the recovery phrase separately. The 12 words belong on paper in a safe place — not as a plaintext note next to your login, and not in the same password-manager entry as the password.
- Use the ZIP backup. DocNado can download all your documents as a ZIP file to your device — your data, your hard drive, no vendor lock-in. A regular backup download is the simplest insurance.
- Local scans stay local. Whatever you save as "private on device" in the DocNado scan dialog never leaves your phone in the first place — it becomes locally searchable PDFs without any cloud upload.
This honest trade-off — maximum security in exchange for owning your key responsibility — is the right deal for most people. But it's your decision, and it should be an informed one.
What a cloud vault doesn't protect — the honest limits
Encryption is a powerful tool, but not a magic shield. Three limits you should know:
Your device is the trust boundary. Decryption happens on your phone or computer — where you view the document. If someone gets hold of your unlocked device, or malware runs on it, they read what you read. The vault protects transmission and storage, not the screen you're working on. Lock your device, install updates, use common sense — that part stays your job.
The key is only as strong as your password — and your phrase. Mentioned above: making the math breakable is hopeless, guessing your secrets is not. Dictionary attacks on "Summer2026!" take seconds. A random 16-character password from a password manager: practically never. The same goes for the 12 words: they only protect you as long as nobody else knows them.
Metadata is part of the truth. Even with unreadable contents, a provider can typically see when you log in, how many documents your vault holds, and how large they are. Zero knowledge means: zero knowledge of contents. For most document workflows that's a theoretical residual risk — but knowing it makes your security picture more accurate.
Anyone who understands these three limits has a more realistic view of security than 90 percent of the marketing pages out there.
Cloud vault vs. regular cloud: the difference at a glance
| Regular cloud | Cloud vault | |
|---|---|---|
| Encryption | on the provider's servers | on your device, before upload |
| Key holder | the provider (and you) | only you |
| Password reset | yes, with full data access | not possible (by design) |
| Server operator can read along | technically yes | technically no |
| On server theft/breach | data accessible with keys | only unreadable ciphertext |
| Accessible from anywhere | yes | yes |
Both columns have their place: for shopping lists and shared vacation photos, a regular cloud is perfectly fine. For invoices, payslips, contracts, insurance documents — everything that is nobody's business but yours — the vault is the right model.
What server location has to do with it
A cloud vault answers "who can read along?" — the question "where is my data stored?" is answered by the server location. DocNado's servers run in Frankfurt, Germany, and processing is GDPR-compliant within the EU. Why that matters too — and what the difference between EU and US servers means in practice — is explained in Frankfurt, Germany: Why European servers matter for your documents.
Frequently asked questions about the cloud vault
I forgot my password — now what? First the regular reset link via email: it resets your login but doesn't open the vault yet. After signing in, DocNado asks for your recovery phrase (the 12 words from setup) once and moves the vault key over to your new password. If you've lost the phrase too, nobody can open the vault anymore — including us.
What happens if DocNado one day stops existing? Your data belongs to you — that's what the complete ZIP export is for. You take all your documents with you, in a standard format, independent of us. "No vendor lock-in" isn't just a marketing word in a vault concept; it's the consequence of "only you hold the key".
Can I still share documents? Yes — sharing and "nobody else can read along" don't contradict each other. When sharing, you decide precisely what to release to whom, for example a single invoice via QR code for splitting costs in your flat share. The vault itself stays closed throughout.
Is a cloud vault GDPR-compliant? Yes — and it goes beyond the requirements. GDPR demands protection of personal data; end-to-end encryption where not even the provider can read the data is the strongest practical implementation of that goal. Where the data lives is covered in the Frankfurt article.
Could the police get to my documents? To the encrypted data, possibly — but they couldn't extract anything without your key. For you as a private person with a folder of receipts that's a rather theoretical scenario; what matters is the principle: what only you can decrypt, no one else can disclose on your behalf.
Getting practical: your first vault visit
Getting started is uncomplicated: create a DocNado account, unlock your document archive once with your decryption key — and from then on, everything you scan lands encrypted in your cloud vault. One receipt, one photo, the AI reads merchant, date, and total, assigns tags, and you find everything again through search.
If you're just starting with digital document management, our receipt scanning tips and the comparison with classic scanner apps like Scanbot are worth a look.
And if you're wondering how long you actually need to keep which documents before they belong in the vault: how long to keep receipts.
Ready to move your paperwork into a vault? Sign up for free — your first scans are included.