You always own your code

Decryption happens on your machine, not ours

When you run sealrepo unlock, the key that decrypts your files is derived from your passphrase, locally. The encrypted files live in your own Git repo, wherever you host it. Sealrepo's servers coordinate team features — sharing, revocation, audit — but they never hold your plaintext, your passphrase, or your keys, so they are never a required ingredient for decrypting your own code.

Day to day, the CLI signs in so team access and revocation work. But the cryptography itself is local, and you always have offline paths to your data (below) that need no account, no network, and no subscription. Your access to your own code is a property of the math and the secrets you hold — not of our uptime or your billing status.

The recovery code: no account, no network

At sealrepo init you were shown a recovery code — a second, independent key wrap created alongside your passphrase. Unlocking with it is the one sealrepo command that works with no sign-in and no internet connection at all:

That means a clone of your repo plus your recovery code is, on its own, enough to get every line of your source back as plaintext. See Passphrase & recovery for rotation and lost-passphrase walkthroughs.

The recovery bundle: a self-contained copy of everything you need

For owners who want a belt and suspenders, sealrepo export-recovery-bundle writes a single, self-contained bundle you can store anywhere — a USB drive, a NAS, cloud storage, a safe — and use to decrypt your vault independently, on any machine, with nothing but the bundle and one of your secrets:

What's inside, and why each piece matters:

• Encrypted key material— your vault's salt and your master key wrapped under your recovery code. Encrypted at rest; useless to anyone without that code.
• The vault manifest — which files are encrypted and the exact cipher parameters used, so decryption never depends on guessing settings.
• A standalone decryptor (decrypt.js) — a script that runs with plain Node.js. It doesn't need the sealrepo CLI installed, doesn't need an account, and never touches the network.
• Plain-text instructions— so the person restoring (you in five years, or your estate's technical contact) can follow along without prior context.

To use it: open the bundle folder on any machine with Node.js and run the decryptor with your recovery code —

Canceling a paid plan never locks you out

The Team plan pays for hosted collaboration: sharing access with teammates, revocation, the audit log, cloud key escrow, CI tokens. If you cancel, those hosted features stop — your ability to decrypt your own code does not. Lock, unlock, recovery unlock, and the recovery bundle are all part of the free CLI and run on your machine. There is no plan state, grace period, or account standing that gates your own passphrase working on your own vault.

Your side of the deal

Zero-knowledge cuts both ways. Because we never see your keys, we can protect you from everyone — including from us — but we cannot rescue you from losing your own secrets. Concretely:

• Keep your passphrase in a password manager.
• Keep your recovery codesomewhere separate and offline — it's shown once at init, and anyone who holds it can unlock the vault.
• Consider exporting a recovery bundle and, on Team plans, cloud key escrow as additional factors.

Frequently asked questions