Ayuda de Filarr

The gate hosted by Filarr

Entrust databases to a gate that Filarr runs for you: what it changes, creating it, the price, sleep, and taking the key back.

En esta página
Secciones de la ayuda

Without a server of your own, Filarr can run the gate for you. The trade-off is simple to state: the databases you entrust to it are no longer end-to-end encrypted while they stay entrusted: their key is managed by our servers. The default stays a gate on your side, where your databases stay end-to-end encrypted.

The hosted gate is open since October 27, 2026, on the Pro, Teams and Enterprise plans.

Price and limits

  • 4 € a month or 48 € a year per box, at the rhythm of your subscription (monthly or yearly). The creation screen shows the price.
  • A Teams or Enterprise organization has one hosted gate included. In the app, a box is billed today on the personal Pro subscription of the person who creates it: billing an organization is not offered there yet.
  • 1,000,000 calls a month per box. Beyond that, the gate answers 429 until the first day of the next month (UTC): nothing more is billed. The access's journal records reaching 80 % then 100 %.
  • The size of the entrusted databases has a ceiling: beyond it, the gate cannot be created.
  • Your plan's limits (sync, volume, writes) apply as they do to a gate on your side.

What it changes

For the databases you tick, and only those:

  • their key is managed by an isolated Filarr service, which decrypts them to answer your software: every row and every column, even those no view shows, and what is written to them while they stay entrusted, are no longer end-to-end encrypted;
  • your software's calls and the answers are not end-to-end encrypted either: they go through an address in gate.filarr.com, managed by the same account as Filarr's API;
  • files the gate receives also pass through our servers without end-to-end encryption.

Your other databases, your notes, your files and your vaults are not affected. The details, with what protects and what does not: Hosted gate: what is no longer end-to-end encrypted.

Create a hosted gate

On the database, click ··· then Open to an API… (Open a database to an API). In Where does the gate run?, choose At Filarr, fill in the rest of the form, then click Continue to the consent. The Agreement to entrust databases to Filarr screen opens:

  1. Read the agreement. Its version (hebergement-v1) and its fingerprint are shown below it; its full text is also in Hosted gate: what is no longer end-to-end encrypted.
  2. Under Check each database you entrust, tick them one by one. None is ticked for you; an unticked database is not opened to this gate.
  3. Tick "I understand that the checked databases will no longer be end-to-end encrypted while they are entrusted to Filarr."
  4. Under Confirm my identity, enter your password, and the two-factor code if it is on, then click Confirm.
  5. Click Entrust 1 database to Filarr: the button says the number of ticked databases.

By entrusting these databases, you also accept the hosted box DPA annex and the offer's terms (Terms, § 3a): the screen links them under the agreement.

Your device draws the access's token and seals it for Filarr's service: nobody sees it, not even you. Filarr then shows you, once, your first app key (gk_live_...): your software presents it to the gate, and Filarr only keeps its fingerprint. Copy it, then click I have put the key aside.

A vault database can only be entrusted by the vault's owner or an admin, and its members are told: see A vault database entrusted to Filarr.

The gate's address

In Settings → API access, the hosted access's card gives its Address, in the form:

https://site-vitrine-7qm2.gate.filarr.com

It answers a few seconds after creation. Its last four characters keep it from being guessed from the name; it is not a secret though: only app keys protect access. The same card shows the Service (EU region, Filarr Gate version, code fingerprint), and for the token: "held by the hosted service · never shown".

Your software uses it like a gate on your side, with the same /v1/... addresses and the app key.

The mark, everywhere

Everyone who sees an entrusted database sees it: on the web, on the desktop and, since version 1.8.0, in the mobile app. At the top of the database: "API hosted by Filarr · not end-to-end encrypted". In Settings → API access: "Hosted by Filarr", followed by the databases' names and "not end-to-end encrypted". The mark is read from the server: no setting hides it.

Payment, plan, sleep

ifthe gate
the subscription is up to date, or within its grace daysserves, unchanged
the payment failed past the grace, or the subscription is cancelledgoes to sleep
the plan goes below Progoes to sleep
the organization forbids hosted gatesgoes to sleep

Asleep, the gate stops serving (it answers 503), and the access shows the state "asleep". Nothing is erased for 30 days: the database shows "Hosted box asleep · key managed by our servers until", followed by the date. Once the payment arrives, the plan is restored or the ban is lifted before that date, it wakes up by itself.

After the 30 days, the key, the copy and the gate's settings (its app keys included) are erased, with a receipt. To erase without waiting, revoke the access.

Take the key back

In Settings → API access, on the hosted access, click Take back the key…. Two paths:

  • Simply revoke: the API stops right away. The hosted service erases the key and its copy, and returns a receipt; the databases' keys change, and anything written to them afterwards is end-to-end encrypted again. Confirm with Revoke and change the keys.

  • Move to my own gate: your software keeps going, with the same app keys and a new address.

    1. Install Filarr Gate on your side (the gate says where and how). Nothing stops meanwhile.
    2. A new token, shown once: it opens the databases for your gate. The hosted gate's settings are passed to it, sealed for it. Start your gate with that token: the screen waits for it to show up, then shows "Your box has imported the settings."
    3. Change the address in your software. You can give your gate's new address: the old one then redirects to it for 30 days (308), reading nothing. Most software drops its key when following a redirect to another name: change the address anyway.
    4. Erase and change the keys: the old token is refused, the service erases the key, the copy and the gate's state, and signs a receipt; your databases move to a new generation of keys.

    Abandon the move cancels the path as long as you have not erased: the hosted gate keeps serving.

Step by step, with the Filarr Gate commands: the round-trip tutorial.

For a vault database, the vault's owner or an admin can also withdraw it from the gate from the database's mark: see A vault database entrusted to Filarr.

The erasure receipt

Every erasure leaves an Erasure receipt signed by the service, kept in the access's journal and shown in Settings → API access: the key generation before and after ("generation 4 → 5"), "key and copy erased", and the service's signature, checked by the app. The receipt proves that the service carried out the order; it cannot prove that no copy exists elsewhere. What is written in the database afterwards is end-to-end encrypted again, under keys the old gate does not have: that is guaranteed by encryption.

Learn more