Vaults

A vault is an encrypted folder on storage you already have, such as Google Drive, Dropbox, a NAS or an S3 bucket. Files are encrypted on your phone or PC before they upload, so your storage provider, or anyone else with access to the storage, sees only scrambled names and data. CloudMount decrypts them on your device as you open them: on Android in the app and the Files app, on Windows in File Explorer, where a vault has its own place in the navigation pane like your other drives.

Vaults are on Android and Windows. They use rclone’s open crypt format, so a vault made on one opens on the other, and with rclone on any computer.

Creating and restoring vaults, and adding files to them, need CloudMount Pro. Opening them and copying files out never does.

Create a vault

On Android:

1. On the home screen, under Vaults, tap New vault.
2. Pick the drive to keep the vault on, and open the folder to put it in. CloudMount makes a new, empty folder there for the encrypted files. If you haven’t added the drive yet, Add a drive brings you straight back.
3. Name the vault.
4. CloudMount generates the vault’s key, six groups of four characters. Save recovery kit or Copy key, and confirm you’ve saved it.
5. Create vault.

The vault appears under Vaults on the home screen and in the Files app. Photo and video backup can also make a vault for its backups (see Offline files, sync and backup).

On Windows:

1. In CloudMount, open Vaults and choose New vault.
2. Pick the drive to keep the vault on, and open the folder to put it in. CloudMount makes a new, empty folder there for the encrypted files. If you haven’t added the drive yet, Add a drive brings you straight back.
3. Name the vault. Its folder takes the same name unless you change it.
4. CloudMount generates the vault’s key, six groups of four characters. Save recovery kit or Copy key, and confirm you’ve saved it. A copied key stays out of the clipboard history and its sync to your other devices.
5. Create vault.

The vault appears in File Explorer’s navigation pane, with a vault icon, and on the Vaults page. A sync task or folder backup can make a vault too: choose New encrypted vault where you pick its drive.

The recovery kit

The recovery kit is a PDF to print or keep in a password manager. It holds:

• the vault’s key, as text and as a QR code that CloudMount can read when you restore the vault;
• the drive and folder the vault is stored in;
• an rclone command that sets the vault up on a computer (on Windows, also one for PowerShell).

A vault’s page shows the key again (Show key) and saves a new kit at any time. On Android, both ask for app lock first when it’s on. On Windows, they ask for Windows Hello, or your PIN or password, when the PC has one set up.

What a vault protects against

A vault protects your files from your storage provider: a breach at the provider, its staff, scanning of your files, or anyone who gets into your account there.

Hidden from the provider	Visible to the provider
What’s in your files	How many files and folders there are, and how they’re nested
File and folder names	File sizes, and when files changed
	The vault folder’s own name

A vault doesn’t protect your files from someone using your device: on the device, CloudMount decrypts them for you.

• Android: the Files app opens them too. Turn on app lock for that.
• Windows: anyone using your Windows account while it’s signed in can open a vault’s files in File Explorer, as they can your other files. Windows Hello guards only showing the key. Files you’ve opened, or kept on this device, are stored on the PC’s disk decrypted, in the vault’s folder under %USERPROFILE%\CloudMount, until you free up their space. Lock your PC when you leave it, and turn on BitLocker or device encryption so its disk is encrypted too.

Keep the key safe

The key is the only way to open a vault. If you lose it, nobody can recover the files: not you, not CloudMount and not your storage provider. CloudMount has no servers and no copy of your key.

• Keep the recovery kit somewhere that isn’t the phone or the PC: a printout, a password manager, or both.
• Anyone with the key and access to the storage can open the vault, so keep the kit as private as the files.
• A vault’s key can’t be changed. A new key would mean encrypting every file again: make a new vault and copy the files into it instead.

Restore a vault

To open a vault on a new phone or PC, after reinstalling, or one you removed from CloudMount, first add the drive the vault is stored on, if it isn’t there yet. Then:

On Android:

1. On the home screen, under Vaults, tap Restore.
2. Pick the drive and open the vault’s encrypted folder: the one the kit names under Stored in.
3. Scan the QR code on the recovery kit, or type the key.
4. Restore vault.

On Windows:

1. In CloudMount, open Vaults and choose Restore.
2. Pick the drive and open the vault’s encrypted folder: the one the kit names under Stored in.
3. Type or paste the key, or choose Read the QR code from a picture and pick a photo or screenshot of the recovery kit.
4. Restore vault.

CloudMount checks the key against a file in the folder and refuses a key that doesn’t open it. An empty folder can’t be checked, so it asks first. A vault made on Android restores on Windows the same way, and the other way round.

Encrypted drives you already have

An encrypted drive that already encrypts the way a vault does can become a vault: file contents and names encrypted with the standard name encryption, and no second password (salt). CloudMount offers this once, on Android’s home screen or Windows’ Vaults page, and keeps the offer in the drive’s settings (Make this a vault). Nothing about how it’s encrypted changes; it gets its place among your vaults, a key you can look up and a recovery kit.

Open a vault on a computer

The recovery kit’s rclone command sets the vault up as an rclone crypt remote. First set up the storage in rclone under the same name it has in CloudMount, then run the command and use the new remote like any other, for example rclone copy "Vault:" ~/Vault. Your exported configuration works too.

Remove a vault

A vault’s page has Delete vault. On Android, choose Remove from CloudMount only or Also delete the encrypted folder; on Windows, Delete, with or without Also delete the encrypted folder.

• Removing the vault only keeps the encrypted folder on the storage. You can restore the vault later with its key.
• Deleting the encrypted folder too deletes everything in the vault from the storage. This can’t be undone. On Windows, CloudMount doesn’t delete the folder while changes in the vault are still uploading, or while a transfer or sync task is using it; try again once they’re done.

Questions

What if I lose my phone or PC?

Your files are safe in the vault on your storage. On a new device, install CloudMount, add the drive and restore the vault with its recovery kit.

Files the lost device had kept were on its storage decrypted. On Android, the phone’s own encryption and screen lock protect them. On Windows, so do BitLocker or device encryption and your Windows sign-in, if they were on.

What if I lose the key?

Nobody can open the vault without it. If the vault is still on a device where CloudMount has it, Show key on its page and save a new recovery kit straight away. Otherwise, the files can’t be recovered.

What if I stop paying for Pro?

Nothing is lost. Your vaults stay, read-only: you can still open everything in them and copy it out.

• Android: in CloudMount and in the Files app. Backups into a vault pause.
• Windows: vaults stay in File Explorer, even beside the one drive the free plan syncs. Deleting or renaming their files is refused. New or changed files stay on the PC, waiting, and upload when you go Pro again. Sync tasks and folder backups pause, as they do on the free plan.

Go Pro again to add files.