Private file storage isolation means your files are architecturally inaccessible to the storage provider — not just secured against outsiders. Standard cloud providers like Google Drive are secure (encrypted) but not isolated (Google can read your files). Gavety achieves isolation by storing your files only on your own hardware and routing access through an encrypted tunnel that Gavety cannot decrypt. Your hardware is the only place your data exists.
What Does Data Isolation Actually Mean?
You probably don't think about data isolation until something goes wrong. A shared drive gets breached. A cloud provider suffers an outage. A company changes its terms of service and suddenly your files are being processed in ways you never agreed to.
According to a Sophos study, attackers attempted to compromise backups in over 94% of ransomware attacks — and more than half of those attempts succeeded. That figure is about enterprise environments, but it points to a principle that applies at every scale: the value of keeping your data genuinely separated from systems and parties that could tamper with or access it.
Data isolation, in straightforward terms, means your data is only accessible to you — not to the infrastructure it runs on, not to employees of the company providing that infrastructure, and not to third parties with legal access to that infrastructure.
NIST defines data isolation as the degree to which data is insulated from unintended access across system boundaries. In practice, this comes down to one foundational question: who holds the keys?
In traditional cloud storage, the provider holds the keys. Files are encrypted at rest — Google uses AES-256, Dropbox uses similar standards — but that encryption protects against external attackers, not against the provider itself. The provider can decrypt your files, and does, for purposes ranging from virus scanning to service improvement to legal compliance.
True isolation means the provider never has the keys in the first place. Your data is inaccessible to them architecturally, not just by policy.
What's the Difference Between Security and Isolation?
These two concepts get conflated constantly, and the confusion is costly.
Security means your data is protected from unauthorized access. Isolation means there is no authorized access except yours.
app.gavety.com. File contents travel directly between your hardware and your browser — Gavety's relay handles connection routing only. No files are uploaded to or stored on Gavety's servers. Gavety cannot decrypt file contents in transit.Google Drive is secure. Security researchers consistently rate its infrastructure against external attackers as strong. The distinction Gavety draws is not that Google Drive is unsafe — it's that Google Drive is not isolated. For most users storing general files, that distinction doesn't matter. For users storing sensitive personal documents, medical records, business files, or anything they'd rather keep entirely off third-party servers — it does.
| Dimension | Gavety (self-hosted) | Google Drive |
|---|---|---|
| Storage | ||
| Where files are stored | Your hardware only | Google's servers |
| Provider can read file contents | ✗ No access | ✓ Yes (scanning, service ops) |
| Encrypted at rest | ✓ Your filesystem | ✓ AES-256 (Google holds keys) |
| Government/legal access to files | Requires physical device access | Google can be compelled |
| Access | ||
| Remote access from anywhere | ✓ Outbound tunnel | ✓ Native cloud |
| Works behind CGNAT | ✓ | ✓ (cloud-hosted) |
| Subject to provider ToS changes | ✗ No | ✓ Yes |
| Continuity | ||
| Available if provider has outage | ✓ Local access always works | ✗ Provider-dependent |
| Data survives provider shutdown | ✓ Files on your drive | ✗ Requires export before closure |
How Gavety Achieves Private File Storage Isolation
Gavety's model is straightforward: your files never leave your hardware.
When you install Gavety on a Raspberry Pi or any Linux device, the agent does two things. It indexes your storage so the file manager interface knows what exists. And it creates an outbound encrypted tunnel from your device to app.gavety.com — the connection path your browser uses to reach your files remotely.
The critical architectural point: file contents travel through this tunnel encrypted, directly between your device and your browser. Gavety's relay handles the connection routing. It does not hold, cache, or process the files themselves. There is no intermediate storage. Nothing is uploaded to Gavety's servers.
Gavety's outbound tunnel is architecturally similar to Cloudflare Tunnel — both create an outbound connection that bypasses the need for inbound port forwarding. The difference is that Cloudflare Tunnel is a general-purpose tool requiring setup and configuration, while Gavety's tunnel is built into the product and configured automatically on install. For self-hosted file storage specifically, Gavety adds the file manager interface and multi-user access on top of the connectivity layer.
How Does Gavety Control Who Can Access Your Files?
Storage isolation is one dimension. Access control is the other.
Who can reach your files depends entirely on what you configure. Gavety supports per-folder permissions — you can give a family member read access to a shared photos folder without exposing your documents, and a colleague write access to a project folder without visibility into anything else on your drive.
Shared links are token-secured and optionally time-limited. A link you generate expires when you set it to expire. Revoking it removes access immediately. There is no “anyone with the link” ambiguity of the kind that catches cloud storage users by surprise — every share is explicit and revocable.
This maps to what security practitioners call the principle of least privilege: every user and every link gets the minimum access necessary for its purpose, nothing more. The difference from enterprise implementations of this principle is the scale: Gavety applies it to individual and family use without requiring IT administration overhead.
Why Does Data Isolation Matter More Now Than Before?
Cloud storage providers have expanded their data processing over time, not contracted it. AI features — document summarisation, smart search, suggested edits — require processing file contents. The more capable these features become, the more access the provider's systems need.
For users who want those features, that is a reasonable trade. For users who want their files to remain genuinely private, the trajectory is moving in the wrong direction.
Self-hosted storage with proper isolation isn't a new concept. What has changed is the setup cost. Configuring a private file server with remote access used to require significant networking knowledge — port forwarding, dynamic DNS, SSL certificate management. The friction was high enough that most people settled for cloud storage by default.
Gavety is built to remove that friction. A single install command on hardware you already own:
curl -fsSL install.gavety.com | bashThe agent connects outward to app.gavety.com. Your files are accessible from any browser anywhere — including behind the CGNAT, where traditional self-hosting approaches fail. The result: private file storage isolation that previously required enterprise infrastructure, available to anyone with a spare Raspberry Pi and ten minutes.
The Trade-Off Worth Knowing
Isolation comes with one genuine trade-off that's worth naming clearly: your data is on your hardware, which means your hardware needs to be running and connected for remote access to work.
If your Pi loses power during a trip, your files aren't accessible remotely until it comes back online. Cloud storage providers have uptime guarantees that a home device cannot match.
For users whose primary concern is keeping files off third-party servers — and who can tolerate the understanding that remote access depends on their own hardware's uptime — Gavety's isolation is genuine in a way that cloud storage cannot be. For users who need guaranteed 24/7 remote access regardless of home infrastructure, a hybrid approach makes more sense: Gavety for day-to-day private storage, with selective backup of critical files to a cloud provider that offers uptime SLAs.
Common Questions About Private File Storage Isolation
Google's privacy policy explicitly states it collects “the content you create, upload, or receive from others when using our services,” including Drive files. Google also explicitly states: “We don't use information in apps where you primarily store personal content — including Drive — for advertising purposes, period.”
The honest summary: Google processes your Drive files for operating the service (virus scanning, malware detection, service improvement) but does not use them for advertising. This is security without isolation — your files are safe from outsiders but not from Google's own systems.
Your files stay on your hardware — they always have been. If your Gavety subscription lapses, you lose remote access through app.gavety.com. But your data remains on your drive, in standard filesystem format, fully accessible locally. You can plug the drive into any Linux machine and read it directly.
This is meaningfully different from cloud storage: if your Google One subscription lapses and your storage exceeds the free 15GB tier, Google restricts uploads and may eventually purge inactive data. With Gavety, cancelling affects access, not possession.
More so than cloud storage, for the reasons described above — files never leave your hardware. For highly sensitive use cases (medical records, legal documents, financial files), the recommended additional layer is full-disk encryption at the OS level using Linux's LUKS. Gavety itself doesn't encrypt the drive — it relies on standard filesystem security. Adding LUKS encryption ensures files are unreadable if the physical drive is lost or stolen.
Frequently Asked Questions
What is the difference between data security and data isolation?
Security means your data is protected from unauthorized access by outsiders. Isolation means the provider itself cannot access your data. A bank vault is secure — outsiders can't break in. But the bank still has the keys. Data isolation is the equivalent of a safe only you hold the combination to — even the bank can't open it.
Google Drive is a secure vault. Gavety is a safe only you control.
Does Gavety work without a Raspberry Pi?
Yes. Gavety runs on any device running Ubuntu or Debian Linux — an old laptop, a desktop, a cloud VPS, or any ARM64 board. The Raspberry Pi is popular because it's small, cheap (~₹5,800–8,000), and uses very little electricity (~5–7W), making it practical for 24/7 always-on use. But any Linux machine works.
How does Gavety handle Indian ISP CGNAT?
Gavety's outbound tunnel bypasses CGNAT entirely. The agent on your device connects outward to app.gavety.com — not inward from the internet. CGNAT only blocks inbound connections. Outbound connections work normally on most ISP.
This is why Gavety works where traditional self-hosting (Nextcloud with port forwarding, for example) fails on Indian residential broadband. For more detail, see our guide to self-hosting without port forwarding.
Can Gavety and Google Drive be used together?
Yes. Many users keep Google Drive for files that benefit from Google Workspace integration (Docs real-time editing, Calendar, Meet) and use Gavety for files they want off Google's servers (financial records, personal photos, sensitive documents). The two don't conflict.
For a comparison of which files suit each, see our private Google Drive alternative guide.
What does the Gavety install command actually do?
The installer at install.gavety.com (viewable in any browser before running) does four things: detects your hardware architecture (ARM64 for Pi, x86_64 for laptops); downloads the Gavety agent binary; installs it as a systemd service that starts automatically on boot; and creates an authenticated outbound tunnel to app.gavety.com. It requires sudo only for the systemd service registration. The agent itself runs as a non-root user.
Your files should be on hardware you own.
Gavety installs in under ten minutes on a Raspberry Pi or any Linux device. Remote access from anywhere — Your data stays on your hardware from day one.
Read the setup guide → Free for LAN use · $100 one-time licence · $20/user/year for remote access