In the digital age, data security and privacy protection are top concerns for users. As a cloud storage service that prioritizes user experience and data security, FEB employs industry-standard encryption technologies to safeguard user data while balancing accessibility and privacy. Below is an overview of our data encryption and storage strategies.

1. Transmission Security: HTTPS/SSL Encryption

During data transmission, FEB utilizes HTTPS/SSL encryption to ensure secure communication between users and servers, preventing data from being intercepted or tampered with during transit. This encryption method has become an industry standard, widely used in internet services such as online banking and digital transactions.

2. Server-Side Storage Security: Data Shuffling Storage

On the server side, FEB adopts a data shuffling storage method to store user data. Specifically:

• Files are not stored in a single location but are fragmented and distributed across different storage units.
• Even if administrators or internal personnel access the storage system, they cannot determine which specific file belongs to which user, ensuring privacy.
• Strict internal data access policies prevent company administrators from arbitrarily accessing user data.

3. Globally Distributed Data Storage: At Least Three Copies

FEB employs a distributed storage architecture to ensure data security and availability. We maintain at least three copies of each file across different geographical locations:

• United States: Data is stored in at least two regions (East Coast, West Coast, or Central).
• Europe: A portion of data is stored in European data centers.
• Global caching nodes: To enhance access speed, we have deployed caching nodes worldwide, allowing users to quickly access their data from any location.

This architecture ensures that even if a data center fails, data can still be retrieved from other storage nodes, guaranteeing security and reliability.

4. Law Enforcement Access Policy

We respect the laws and regulations of various countries while upholding users' right to be informed. FebBox’s data access policy includes:

• Any law enforcement agency requesting user data must provide a formal legal request.
• Where legally permissible, we will notify affected users, informing them of the data access request.
• We will publish an annual transparency report detailing the number of data access requests from each country, ensuring users remain informed about access to their data.

5. Server-Side Encryption: Why We Don't Use It

We do not implement server-side encryption for user data storage for the following reasons:

1. Lack of Practicality: If decryption keys are stored solely on user devices, data may become irretrievable if a user changes devices. Currently, no cloud storage service requires users to use their old device to access data, as this approach is impractical.
2. Encryption Is Meaningless if Keys Are Held by the Service Provider: If encryption keys are managed by the cloud storage provider, the provider can still decrypt user data. This renders encryption ineffective, merely increasing computational costs without genuinely enhancing data security.

6. The Reality of End-to-End Encryption Claims by Other Cloud Storage Providers

Many cloud storage providers claim to use end-to-end encryption, but their implementations raise serious questions about their practicality:

• Dropbox: Claims to offer end-to-end encryption but does not explicitly state how users can recover data if they lose their device. If encryption keys are only on the user’s device, then when switching to a new device, the user must have access to the old device. However, if data can be restored on a new device without the old one, the encryption keys must be stored on the company’s servers, making "end-to-end encryption" meaningless.
  Source: Dropbox
• Box: Similar to Dropbox, it provides enterprise-level encryption features, but how encryption keys are managed remains unclear. If Box can help users restore data, then Box must also have access to decryption keys.
• TeraBox: Primarily focuses on offering large amounts of free storage, but it does not provide detailed encryption policy disclosures. The lack of transparency raises concerns about how secure its storage truly is.
• Mega: Known for its strict encryption policies, Mega claims to use end-to-end encryption where only the user holds the decryption key. However, Mega does not explain how users can retrieve their data if they lose their device. If the encryption key is truly stored only on the user’s device, a lost device should mean permanent data loss. Yet, users can still recover their data—suggesting Mega retains some form of key backup, contradicting its end-to-end encryption claim.

If a cloud storage provider claims to use end-to-end encryption, yet users can restore their data on a new device without requiring the old one, then the encryption keys must be stored on their servers. This effectively negates the idea of true end-to-end encryption, making it more of a marketing strategy rather than a real security measure.

7. FEB’s Commitment to Data Security and Transparency

Unlike competitors that make questionable end-to-end encryption claims, FebBox is transparent about its security practices:

• Data shuffling storage ensures that even our servers cannot reconstruct a complete file.
• Distributed storage guarantees high data availability and security.
• We do not mislead users with “pseudo end-to-end encryption”—instead, we provide practical and secure solutions that ensure both data privacy and usability.

Moving forward, FEB will continue optimizing its security strategies to balance data protection and accessibility, providing users with a genuinely secure and reliable cloud storage service.