GPG recryption, also known as re-encryption or re-keying, decrypts a file and immediately re-encrypts it using a different key. This process keeps files encrypted at rest while allowing secure access for other processes that use a new encryption key.

At no point is the unencrypted version of a file ever stored or visible. Files.com decrypts and re-encrypts the file entirely within temporary system memory, where the clear content exists only for the duration of the operation. The unencrypted data is never written to disk, does not persist in memory after processing, and is never accessible to Files.com employees or any other party.

Files.com administrators can enable GPG recryption on a per-folder basis. When enabled for a folder, any files uploaded to that folder or its subfolders are automatically decrypted and re-encrypted, unless you explicitly disable the setting in a subfolder.

On a Remote Server Mount, the setting processes files arriving by upload, copy, move, or Sync. Files.com stages them in Native Storage before remote delivery, even when the Remote Server's Buffered Uploads setting is Never. GPG on Remote Server Mounts explains the required processing and alternate access paths.

Recryption requires a GPG/PGP private key for decryption and one or more GPG/PGP key pairs for re-encryption. You can use different keys for each folder and select multiple public keys for re-encryption. Files uploaded to these folders are decrypted using the private key and then re-encrypted using the selected public keys. You can also choose to sign the re-encrypted file.

If Files.com cannot decrypt a file with the chosen private key, the file remains unchanged. Only files encrypted with a matching public key can be decrypted. Files.com requires unexpired keys for both decryption and re-encryption. If the original private key has expired, renew that same key and import its updated key material so it can still decrypt files encrypted to the original public key.

The Limit uploaded files to certain extensions folder setting can require filenames ending in .pgp or .gpg to keep incoming names consistent with your workflow. It checks the filename only; it does not verify encryption or prevent unencrypted contents with an allowed extension from being uploaded.

When you enable GPG recryption, files that existed in the folder beforehand remain unchanged. To apply re-encryption to those files, re-upload them after enabling the setting.

Using Existing Keys From the GPG Key Manager

Select one or more decryption and encryption keys from the available key list. You can optionally select a signing key.

Choose an output format: Binary (default) or ASCII Armor if you need text encoding.

You can also enable the Ignore MDC integrity check option to bypass any modification detection code errors.

GPG Recryption

Using Existing Keys From the GPG Key Manager

Providing Your Own Keys

Creating New Keys

GPG Signing

Error Notifications