Your unreleased music
stays unreleased.

Encrypted before it leaves your Mac

Each file is cut into pieces and every piece is encrypted on your Mac (AES-256-GCM) before it uploads. Our servers and our storage provider, Backblaze, only ever hold the scrambled pieces.

File and folder names are hidden too. The records of what each file is called, where it lives and which pieces it's made of are encrypted on your Mac. Our server sees each path only as a fingerprint it can't read back.

Pieces are named by a keyed fingerprint of their contents, so nobody can test whether a known sample pack is in your Vault by looking for its pieces.

The key

Your Vault has one key, made on your first Mac and kept in its Keychain. It never goes to our servers. Another Mac gets it in one of two ways: through iCloud Keychain, if you turn that on, or by typing in your recovery key.

The recovery key is that key written out as 55 letters and numbers. It's in Settings, under Recovery, where you can copy it or save it to a file. Keep it somewhere safe: anyone who has it can open your Vault, and if you lose every Mac and the recovery key, we can't get your sounds back for you.

Sound search stays on your Mac

⌥Space listens to your sounds with a model that runs on your Mac. No audio is ever sent to us or anyone else to work out tempo, key or feel. The fingerprints it makes are saved in your Vault, encrypted like everything else, so your other Macs don't have to redo the work.

What our servers can see

Encryption hides what your files are and what they're called. To keep your Macs in step, our server still sees:

• how many files and versions you have, and the size of each one
• when each change was made, and whether it was a save, rename, copy, restore or delete
• which of your Macs made it (as an id, not its name)

Our own logs record which kind of request was made, whether it worked and how long it took. They don't record IP addresses, though our hosting providers (Cloudflare and Backblaze) see them, as any web service does.

Ask MusiDrive

When you ask MusiDrive to organise a folder, it has to read the file list to plan the moves. Your Mac sends that folder's file paths, kinds and sizes, along with what you typed, through our server to DeepSeek's AI service. No audio and no file contents are sent. Nothing moves until you approve the plan, and nothing is sent unless you ask.

Importing from a link

A pack you import from a Dropbox, Google Drive or download link has to be downloaded and unpacked somewhere before it can be encrypted. Our import computer does that: it unpacks the files, encrypts them with a one-off key your Mac made for that import, uploads them, and deletes its copy as it goes. While it works, it can see those files. If you'd rather nothing is ever readable outside your Mac, download the pack yourself and add the folder from your Mac. Link import isn't switched on yet during the beta.

On your Mac

Sounds you've played or kept are stored on your Mac unencrypted, so your DAW can read them at full speed. They're protected the way the rest of your Mac is, so keep FileVault on (System Settings › Privacy & Security).

A lost or stolen Mac

From another Mac, sign the lost one out in Settings, under Macs. It can no longer reach your Vault or sync anything.

Signing out doesn't erase that Mac, though. Sounds already on it stay there, and so does the Vault key in its Keychain. That's another reason to keep FileVault on and a login password set: without them, someone with the Mac could read what was on it.

Undo

When you replace or delete a file, the old version is kept for 30 days and you can bring it back from any of your Macs. After that it's removed for good.

Found a problem?

If you think you've found a security issue, email josepheddjr@gmail.com and tell us what you found.