TeraCryption
Enterprise File Encryption System
Control File Sharing
1. Who controls encrypted file sharing?
With TeraCryption Standard, the administrator creates Groups and assigns users to them. Users can encrypt files to Groups to which they are assigned, and only users assigned to the corresponding Group are authorized to decrypt those files. A Group can represent a department, project, experiment, client or other authorized working environment.
TeraCryption Enterprise adds File Ownership control. The administrator determines which users receive File Ownership rights. When an owner encrypts a file to a Group, the owner can select which members of that Group are permitted to decrypt an individual file they own. The owner can later add or remove authorized Group members as sharing requirements change.
This separates organizational control from individual file control. The administrator controls who may belong to the Group and who receives File Ownership rights; the file owner controls which authorized members of that Group may decrypt the individual files they own. The administrator cannot independently change the decryption permissions established by the owner.
administrator controls Group membership → assigns ownership rights → owner selects Group members → owner controls file sharing
2. Can a file owner change the decryption permissions of an already-encrypted file?
Yes. With TeraCryption Enterprise, the owner can review which authorized Group members are currently permitted to decrypt an owned file and change those permissions when business requirements change.
The owner can remove users who no longer need access or grant permission to other authorized members of the same Group. The encrypted file does not need to be decrypted, copied or redistributed simply because its sharing permissions have changed.
The file remains encrypted while its decryption permissions are changed.
review sharing → add or remove users → update permissions → keep file encrypted
3. Can someone open an encrypted file simply because another user sends it to them?
No. In Plans 2, 3 and 4, users cannot retrieve the encrypted files stored in the shared Group folders on the server or cloud storage service. TeraKey presents authorized users with the Group files available to them through Windows File Explorer while the encrypted files remain in their designated storage location.
Encrypted Group files stored in a user's My TeraKey folder contain the encrypted data and can be sent to another person. However, possession of that encrypted file does not provide permission to decrypt it. The recipient must be a TeraCryption user assigned to the same Group to which the file was encrypted and must successfully log in to TeraKey.
The recipient cannot obtain access simply by using another person's TeraKey login because TeraKey requires the individual user's authentication and verification.
Authorization—not possession of the encrypted file—determines who can decrypt its contents.
receive encrypted file → authenticate user → verify Group authorization → decrypt if authorized
4. Do users need to create, store or exchange encryption keys when sharing encrypted files?
No. TeraCryption manages the encryption process automatically. Users do not create, store, exchange or enter encryption keys when sharing encrypted files.
Users decide the Group to which a file should be encrypted. With TeraCryption Enterprise File Ownership, an owner can additionally select which authorized members of that Group are permitted to decrypt an individual owned file.
When sharing permissions change, users do not distribute new encryption keys or manually manage cryptographic information. TeraCryption automatically handles the encryption process while the users concentrate on deciding who should have access.
select Group → encrypt file → control authorized users → no keys to manage
5. How can an organization review who can currently decrypt its encrypted files?
TeraCryption Enterprise provides the administrator with visibility into file-sharing relationships. The administrator can use the Shared File Information List to review and filter file-sharing information by file owner and Group.
File owners can also see who has permission to decrypt their owned files. When responsibilities, projects or business requirements change, owners can review their current sharing permissions and remove access that is no longer required.
This allows the organization to periodically review whether access that was appropriate when an encrypted file was originally shared is still required today.
review access → identify unnecessary permissions → owner changes sharing → maintain current access
6. What happens to encrypted files when their owner leaves the organization or changes responsibilities?
TeraCryption Enterprise provides a controlled process for transferring File Ownership when an owner leaves the organization, changes responsibilities or another authorized user must assume responsibility for the files.
The administrator can request the transfer of one, some or all of the owner's files, but cannot independently perform the ownership change. A separately designated company executive must approve the transfer, and the TeraCryption administrator cannot designate themselves as the executive authorized to provide that approval.
After approval, the TeraCryption service performs the ownership change and notifies the parties involved. The new owner can then assume responsibility for the encrypted files and their sharing permissions.
request transfer → executive approves → TeraCryption transfers ownership → new owner assumes control