Encrypted backup and storage

Before you begin

• A signed-in account, an authorized device and available storage in the selected personal or Organization pool.
• A verified MFA session before encryption setup and encrypted backup operations; a safe place outside NotzUp for your recovery-key copies.

Step by step

1. Verify MFA before setup

   Open Accounts/devices/security, configure your own authenticator if needed and complete verification. Encryption setup and protected operations require verified MFA, not merely a password or social sign-in.

2. Create or import the key

   Open Backup & Encryption to generate or import a recovery key. Download the .notzup-key file and keep protected copies. Key handling is local; the recovery key never reaches NotzUp.

3. Manage key copies safely

   Check the fingerprint when importing. You can download, import, regenerate and manage the key. Regenerating makes a new key; it does not make earlier backups decryptable with the new key. Retain the old key for old backups. Forgetting the browser key removes that local copy, not every downloaded copy.

4. Select the storage space

   Choose personal or an Organization you are authorized to use. These are separate shared quotas. Authorized devices share the selected pool; adding a device does not create a new storage allowance.

5. Back up reviewed results or inventory

   Create the content backup in the native app. Results and inventory backups are encrypted on the device before upload. NotzUp stores the encrypted envelope plus file metadata and quota usage, not your recovery key or decrypted backup.

6. Manage cloud files

   On the web Storage page, select the personal or authorized Organization pool and review used, available and total storage. Filter stored files by source device, inspect dates and download or delete only authorized files; protected operations require 2FA. Backup & Encryption manages the recovery key and compatible dated backup downloads. The website does not decrypt or restore native content. Use Settings for enrolled devices and supported account-session controls, not a complete session inventory.

7. Restore on a new installation

   In a compatible native installation, sign in and enroll the device within current limits. Verify 2FA, choose the correct pool and dated compatible backup, import its matching recovery key and restore locally using the native client’s supported restore control. Web download is not itself a restore. Check the restored content before replacing local work.

8. Keep settings backup separate

   Settings snapshots contain typed app preferences, not transcripts, media or inventory. Settings backup and restore is a distinct workflow and cannot recover encrypted content.

9. Matching keys, source devices and storage pools

   AES-256-GCM encryption happens on the source device before upload. Key setup and management require verified 2FA. The recovery key is never uploaded.

   A new or regenerated key cannot decrypt old backups. Retain the matching key for each backup; losing every copy makes that backup unrecoverable.

   Authorized mobile and desktop devices share the selected personal or Organization pool; the pools are separate. Web and app show quota, files, source device and dates. Download or delete the exact authorized file; restore/decryption runs locally in a compatible app, not on the website.

   On a new installation, sign in, authorize the device, verify 2FA, import the matching key and select a dated backup from a specific source device. Review the local restore before replacing work. Enrolled devices and supported session controls are in Settings; settings snapshots are not content backups.

Expected result

Encrypted content in the correct shared pool and a locally restored compatible dated backup using the matching recovery key.

Privacy and permissions

Recordings, files, searches, scans, OCR, barcode counts and supported local-AI results do not leave the device by default. Only a deliberate online action—Share, Search online, connector authorization or encrypted backup—transmits the selected data or value. Language-pack downloads do not upload the source text. Encryption uses client-created AES-256-GCM envelopes. The server sees metadata and encrypted files, never recovery keys or decrypted content. This is not a blanket zero-knowledge claim about accounts or metadata. Losing every copy of the matching recovery key makes existing encrypted backups unrecoverable; NotzUp cannot reset that key for you.

Troubleshooting