To set up zero-knowledge encryption in Tresorit Business, you create end-to-end encrypted workspaces called "Tresors," enforce a company-wide encryption policy through the Admin Center, and verify that client-side key generation is active — meaning encryption and decryption happen only on user devices, never on Tresorit's servers. The process takes under 30 minutes for a fully configured team deployment.
What You'll Accomplish and Why It Matters
This guide walks you through configuring Tresorit Business so that zero-knowledge encryption is not just available but enforced company-wide — no user can accidentally opt out, no admin can override it from the server side, and every file at rest and in transit is encrypted with keys that never leave your devices.
Tresorit is headquartered in Zurich, Switzerland (with EU operations under GDPR) and is third-party audited. For teams handling sensitive client data — legal, medical, financial — the configuration difference between "encryption available" and "encryption enforced" is the difference between a defensible compliance posture and a liability. If you're evaluating complementary tools, our best enterprise password manager review for 2026 pairs well with this setup.
Prerequisites / What You'll Need
- Tresorit Business plan — $15.00/user/month billed annually, 3-user minimum (as of 2026 pricing). The Business plan is required; the Personal and Solo tiers don't expose the Admin Center policy controls covered here.
- Admin Center access — You must be assigned the Organization Admin role, not just a Team Admin.
- Tresorit desktop client — Version 3.8 or later on Windows 10/11 or macOS 13 Ventura and above. The full desktop client is required for key generation; browser-only access bypasses local key generation.
- MFA authenticator app — Google Authenticator, Authy, or any TOTP-compatible app; or a FIDO2-compatible hardware key (YubiKey 5 series confirmed compatible).
- At least one test Tresor — A folder you can use to verify encryption status without risking production files.
- User roster ready — Email addresses for all seats you're provisioning, or an Active Directory / Azure AD connector if you're using SSO.
Step 1: Access the Admin Center and Audit Your Current Policy State
Log into tresorit.com and click Admin Center in the top-right menu. If you don't see Admin Center, your account isn't set to Organization Admin — contact your Tresorit account owner to elevate your role before continuing.
In the left sidebar, go to Security → Security Policy. You'll see a dashboard showing current encryption enforcement status, MFA adoption rate (shown as a percentage of users enrolled), and any active policy exceptions.
Expected output: A policy status card labeled either "End-to-End Encryption: Enforced" or "End-to-End Encryption: Available (not enforced)." Most new Business accounts default to "Available," not "Enforced."
Common gotcha: If you see a "Legacy browser sessions active" warning, users have logged in via browser without the desktop client. These sessions use a server-assisted key mode. You must resolve this before enforcement will be airtight — see Step 4.
Step 2: Enable End-to-End Encryption Enforcement
In Security → Security Policy, click Edit Policy. Toggle "Enforce End-to-End Encryption" to ON. This triggers a policy cascade: Tresorit will now block any login or file-access session that cannot confirm client-side key availability.
Scroll down to the Browser Access section. Set "Allow browser-only access" to Disabled. Browser sessions in Tresorit's web app do support a form of client-side encryption via WebCrypto API, but disabling pure browser access ensures all key operations go through the hardened desktop or mobile client rather than a browser sandbox.
Click Save Policy. Tresorit will prompt: "This change will log out all active browser-only sessions. Confirm?" Click Confirm.
Expected output: A green banner: "Security policy updated. Enforcement active as of [timestamp]." Users in browser-only sessions will receive an email notifying them to install the desktop client.
Common gotcha: If you have external collaborators (guests invited to a Tresor), this policy does not automatically enforce on guest accounts. Guest encryption behavior is controlled per-Tresor — covered in Step 5.
Step 3: Configure Key Derivation and Verify Encryption Specifications
Tresorit uses AES-256 for file encryption at rest, combined with RSA-4096 for key exchange between users sharing a Tresor. Per Tresorit's published cryptographic white paper (last updated Q1 2026), user passwords are never transmitted — the client derives a local key using PBKDF2-SHA256 before any network communication occurs.
To verify this is active on your admin account: open the Tresorit desktop client, right-click any Tresor, and select Properties → Encryption Details. You should see:
- Encryption: AES-256
- Key type: End-to-end (client-generated)
- Key holder: [Your email]
Expected output: The "Key holder" field lists user email addresses — never "Tresorit" or "Server." If you see "Server-managed key," that Tresor was created under a legacy configuration and must be migrated (see Troubleshooting).
Step 4: Enforce MFA Across the Organization
Return to Admin Center → Security → Authentication. Under Multi-Factor Authentication, set the dropdown to "Required for all users."
Tresorit Business supports the following MFA methods:
- TOTP (Google Authenticator, Authy, 1Password TOTP) — most common
- WebAuthn / FIDO2 — hardware security keys (YubiKey 5C NFC confirmed; also passkeys on supported devices)
- Email-based OTP — available but I'd recommend against it for high-security deployments; it's the weakest option here
SMS-based MFA is not supported in Tresorit Business as of 2026 — which is actually a security positive, since SIM-swap attacks are a real threat vector.
Set Grace Period to 24 hours (Tresorit allows 0–72 hours), giving users time to enroll without being locked out immediately.
Expected output: After saving, the MFA adoption dashboard updates in real time. Users who haven't enrolled see a banner on next login requiring setup before they can access any files.
Common gotcha: Admin accounts are not exempt from MFA requirements. If you lock yourself out, Tresorit support can initiate a recovery process, but it requires identity verification and takes 24–48 hours.
Step 5: Create and Configure Tresors with Zero-Knowledge Settings
A "Tresor" is Tresorit's name for an encrypted workspace — the fundamental unit of access control and key management. Each Tresor has its own AES-256 key, and sharing a Tresor with a colleague means re-encrypting that Tresor key with the colleague's RSA-4096 public key.
To create a compliant Tresor:
- In the desktop client, click + New Tresor
- Name it and select a sync location on local storage
- Under Sharing Settings, set "Who can invite members" to Admins only (prevents users from sharing sensitive folders without oversight)
- Under Guest Access, set "Require guest installation of Tresorit client" to ON — this enforces client-side encryption for external collaborators
For existing Tresors created before policy enforcement, right-click → Settings → Re-encrypt Tresor. This generates a new AES-256 key and re-encrypts all contents. Expect this to take 5–30 minutes depending on Tresor size.
Expected output: Tresor icon shows a closed padlock. Right-click → Properties → Encryption Details confirms "End-to-end (client-generated)."
Step 6: Configure Audit Logging
In Admin Center → Compliance → Activity Log, enable "Log all file operations." Tresorit Business logs: file uploads, downloads, deletions, share invitations, permission changes, and login events — all with timestamps and user attribution.
Export logs via the Export CSV button or connect to a SIEM via Tresorit's Activity Log API (available on Business plan). Log retention is configurable from 30 to 365 days on the Business tier.
Tresorit holds a SOC 2 Type II certification and has undergone ISO 27001 auditing. For precise auditor names and dates, request the audit report directly from your Tresorit account manager — they provide it under NDA to Business customers.
Verification — Confirm Zero-Knowledge Is Actually Active
Run these three checks before declaring the configuration complete:
- Encryption Details check: Right-click a Tresor in the desktop client → Properties → Encryption Details. Key holder should list user email(s), not "Tresorit Server."
- Policy dashboard check: Admin Center → Security → Security Policy should show "End-to-End Encryption: Enforced" and "Browser-only access: Disabled."
- Network traffic check (optional, advanced): Use Wireshark or Charles Proxy on your workstation and upload a test file. The payload should be unreadable ciphertext — you should not see your filename or file contents in cleartext in any request to tresorit.com.
If all three pass, your zero-knowledge configuration is active and enforced.
Recommended Tools to Complement Tresorit Business
Encrypting files in transit and at rest is only one layer. Two gaps remain: password hygiene for the Tresorit account itself, and network-layer exposure on remote devices.
Secure Hosting for Your Business Web Properties
If your team runs internal tools, a client portal, or a documentation site alongside Tresorit, the hosting environment matters. WP Engine offers managed WordPress hosting with SOC 2 compliance, automated daily backups, and TLS enforcement at $25/month for the Starter plan (1 site, 25,000 monthly visits). For security-conscious businesses already investing in zero-knowledge file storage, pairing that with a managed host removes one more attack surface. WP Engine also includes Global Edge Security (powered by Cloudflare) on all plans, adding DDoS mitigation and a WAF without extra configuration.
Try WP Engine — SOC 2-compliant managed hosting that matches the security posture of a zero-knowledge file setup.
For teams on tighter budgets, SiteGround offers managed WordPress hosting starting at $3.99/month (introductory) / $17.99/month renewal for the StartUp plan (1 site, 10 GB storage). SiteGround includes Let's Encrypt SSL, server-side encryption at rest, and daily backups. It's not SOC 2 certified, but it meets baseline GDPR data processing requirements for EU-based teams. If your primary concern is cost while maintaining reasonable security hygiene, SiteGround is the practical choice.
Try SiteGround — GDPR-ready managed hosting at a price point that makes sense for small Tresorit Business deployments.
If your team also needs VPN coverage for remote work sessions — especially relevant when accessing Tresors on untrusted networks — our best VPN for small business employees in 2026 covers the strongest options available this year.
Troubleshooting
Issue 1: "Server-managed key" appears in Tresor Encryption Details
Cause: The Tresor was created before E2E enforcement was enabled, or was created via the web app in browser-only mode.
Fix: Right-click the Tresor → Settings → Re-encrypt Tresor. You must be the Tresor owner. If you're not the owner, have the owner run re-encryption or transfer ownership via Admin Center → Content → Tresors.
Issue 2: "Your security policy blocks browser access" error after policy change
Cause: A user is attempting to log in via tresorit.com without the desktop client installed.
Fix: Direct the user to download the Tresorit desktop client (version 3.8+ for Windows 10/11 or macOS 13+). The browser app will remain blocked until client installation is confirmed. Point them to the download link in the lockout email Tresorit sends automatically.
Issue 3: MFA enrollment screen loops without completing
Cause: TOTP time sync is off on the user's device.
Fix: On Android: Settings → General Management → Date and Time → Enable "Automatic date and time." On iOS: Settings → General → Date & Time → Set Automatically. Retry enrollment. If using a hardware key and enrollment loops, try a different USB port or USB-C adapter; WebAuthn can fail silently with certain hubs.
Issue 4: Guest collaborator can access Tresor via browser (bypassing client requirement)
Cause: The per-Tresor guest setting "Require Tresorit client for guests" was not enabled on that specific Tresor.
Fix: Right-click the Tresor → Settings → Sharing → enable "Require guest installation of Tresorit client." This setting must be toggled individually per Tresor — it is not inherited from the global policy for guest accounts.
Issue 5: "Policy conflict detected" error in Admin Center
Cause: Your Tresorit account is connected to an Azure AD or Okta SSO provider that has its own MFA policy, creating a conflict with Tresorit's native MFA requirement.
Fix: In Admin Center → Authentication → SSO Settings, set "MFA source" to "Identity Provider" and disable Tresorit's native MFA requirement. Your IdP's MFA policy then governs all sessions. Confirm your IdP enforces TOTP or FIDO2 — don't assume it does.
FAQ
Does Tresorit Business actually prevent Tresorit employees from reading my files?
Yes. Tresorit's zero-knowledge architecture means file encryption and decryption happen exclusively on client devices using AES-256. The encryption keys are derived locally from user credentials via PBKDF2-SHA256 and are never transmitted to Tresorit's servers in cleartext. Tresorit's servers store only ciphertext. A Tresorit employee with full database access — or an attacker who breaches Tresorit's infrastructure — cannot decrypt your files without access to the private keys on your users' devices. This is verifiable by inspecting network traffic during a file upload, which should show only ciphertext payloads.
What happens to my files if I forget my Tresorit password?
Password recovery in a zero-knowledge system is a fundamental limitation: because Tresorit never holds your encryption key, they cannot decrypt your files to restore access after a forgotten password. Tresorit Business mitigates this with an Admin Recovery feature, where the Organization Admin can hold a recovery key (generated at account creation) to regain access on behalf of a user. This recovery key should be stored in an offline, encrypted vault — not in Tresorit itself. Without the recovery key, files in that user's personal Tresors are permanently inaccessible. Shared Tresors remain accessible to other members.
Is Tresorit Business compliant with HIPAA, GDPR, and SOC 2?
Tre