Protect files with on-the-fly encryption and decryption.
Create transparent encryption policies that grant access only to trusted processes, all others see ciphertext.
USE CASES
What you can build with CBFS Encrypt
Enforce file encryption with per-process access control. No kernel driver code required.
Protect data at rest from unauthorized processes
Encrypt files so only trusted processes can read the plaintext. Anyone else, including malware, sees ciphertext.
Compliance-driven encryption policies
Apply encryption rules to specific directories to meet data-at-rest requirements, without changing how your app reads or writes files.
HOW IT WORKS
Encryption enforced by process, not by hand.
CBFS Encrypt uses a minifilter driver to catch file requests that match your encryption rules. Data gets encrypted on write and decrypted on read, automatically.
Access is controlled per process. Trusted processes see decrypted files. Everyone else, including a user browsing the folder, sees only ciphertext.
Encryption happens at the driver level, so nothing changes in the apps reading or writing the protected files.
START BUILDING
Documentation & Resources
Online Documentation
Full API reference for all components and languages, with code examples for every method and event.
Read now
Knowledge Base
Troubleshooting guides, how-tos, and answers to common implementation questions.
Read nowGetting Started With CBEncrypt
A step-by-step guide for creating transparent encryption policies with CBEncrypt.
Read nowSample Applications
Shows how to encrypt files and allow access only to trusted processes.
FEATURES
Comprehensive Features for Maximum Performance
Secure Files and Enforce Access Restrictions
Secure Files and Enforce Access Restrictions
Implement on-the-fly file encryption, using modern cryptographic algorithms, for deeply-integrated data security. Leverage intelligent access rules to enforce targeted access restrictions via a modern minifilter driver.
Transparent File Encryption
Automatically encrypt files on disk and decrypt them on-the-fly, keeping sensitive data protected at all times. Flexible encryption rules make it easy to protect specific directories according to your needs.
Proactively Intercept and React to Requests
CBFS™ Encrypt's robust, rules-based encryption and decryption engine is flexible enough to handle use-cases of any scale and complexity. Target the file requests you care about, and let the encryption and decryption occur quietly in the background.
File Isolation
File isolation allows different processes to see different file contents when viewing the same file. For example, one process may see decrypted content, while another process would see only encrypted data.
Process-Based Access Control
Define which processes are permitted to access decrypted file contents. Authorized processes see data transparently decrypted according to your encryption rules, while all other processes interact only with the encrypted form of the file.
Simple Deployment
The simplified deployment scheme eliminates architecture detection and potential errors. A single CAB file contains all of the drivers and Helper DLLs that are necessary for driver installation.
PLATFORMS
Supported Languages & Operating Systems
Every edition ships with a pre-built driver, sample applications, and full documentation. 30-day fully functional trial for all editions.
CBFS Encrypt supports .NET Framework 4.0+ and .NET 5 through .NET 10 with a robust Windows-only driver, full Visual Studio integration, and C# sample applications.
Documentation
CBFS Encrypt ships as 32-bit and 64-bit Windows DLLs built on our high-performance C++ codebase, with precompiled binaries for x86/x64 and ARM.
Documentation
CBFS Encrypt provides Java classes supporting JDK 1.7 and up, managing a robust Windows-only driver, with full Javadoc and seamless integration into IntelliJ and Eclipse.
Documentation
CBFS Encrypt ships as Python 3 modules managing a robust Windows-only driver, installable via PIP with comprehensive HTML documentation and sample applications.
Documentation
CBFS Encrypt ships as Rust crates built on top of 32-bit and 64-bit Windows DLLs, with support for x86/x64 and ARM architectures.
Documentation
CBFS Encrypt provides high-performance, C++-based Go packages built as 32-bit and 64-bit Windows DLLs, supporting Go 1.13 and later.
Documentation
CBFS Encrypt provides native Delphi VCL components wrapping a Windows-only driver, supporting every Delphi version from Delphi 6 through RAD Studio 13.
Documentation
CBFS Encrypt ships as 32-bit and 64-bit Windows DLLs supporting Qt 4.8 and Qt 5, with seamless Qt Creator integration and Qt GUI sample applications.
DocumentationFAQ
Frequently Asked Questions
Common questions about licensing, integration, and deployment.
What is CBFS Encrypt?
CBFS Encrypt is a Windows SDK for enforcing file encryption policies with per-process access control. A minifilter driver encrypts files on disk and decrypts them on the fly for processes you trust. Every other process only ever sees the encrypted bytes.
Built for protecting data at rest without requiring end users or trusted apps to do anything differently. Rules can target specific directories or file types. Deployment is a single CAB file, no custom driver work.
How do I add transparent file encryption to my application without writing driver code?
CBFS Encrypt handles the driver layer for you. Define encryption rules, target directories, extensions, or patterns, and list which processes are trusted to see decrypted content. The minifilter driver intercepts reads and writes matching those rules and applies encryption or decryption automatically.
Use the CBEncrypt component API in .NET, C++, Java, Python, Rust, Go, or Delphi. No kernel code. A sample project shows a full working setup.
How does transparent on-the-fly encryption work in CBFS Encrypt?
When a file covered by a rule is written, the minifilter driver encrypts the data before it hits disk. When a trusted process reads that file, the driver decrypts it on the way out. The trusted process sees plaintext and has no idea encryption is happening.
Any process not on the trusted list gets the raw encrypted bytes. The file on disk is always encrypted. No separate encryption step, key management UI, or user action needed.
What is process-based access control in CBFS Encrypt?
Process-based access control decides which processes can see decrypted file contents. Trusted processes are identified by executable path or digital signature. Open a file from a trusted process and it's decrypted transparently. Everything else gets the encrypted form.
This gives you per-app data isolation, DRM enforcement, and zero-trust data-at-rest, even against users with admin rights.
What encryption rules and policies does CBFS Encrypt support?
CBFS Encrypt uses a rules engine that targets directories, file extensions, or filename patterns. Rules can cover a whole directory tree or just specific file types within a path, from a single app data folder to a full enterprise storage layout.
Encryption uses modern cryptographic algorithms built for both security and performance, so file access stays fast.
Start with a free 30-day trial
Fully functional, no feature restrictions. Free technical support from day one. No credit card required.
TRUSTED BY DEVELOPERS WORLDWIDE
Built for production. Proven at scale.
Components and drivers from Callback Technologies have been shipping in commercial products for over two decades, from single-developer tools to enterprise software deployed at Fortune 500 companies.
Our data need to be accessed quickly, but not exposed to other users or applications. On-the-fly encryption of data provided by your component came very handy. You've got a great product and nice team. Thank you.
Great product! And with all these updates and excellent support really makes me think its 100% worth the money.