Your documents are sealed on your device and stay sealed in the cloud. Here is the whole path — including the one step where a document is readable.
The journey of one document
Plaintext exists in two places only: on your own devices, and for the length of a single analysis call.
Who holds the keys
What the server can see
Encrypted
The document itself. Its filename, summary, labels, dates and embeddings — every one of them rides inside the ciphertext.
Visible
Routing metadata: which library a record belongs to, its id and version, which device wrote it and when, and how large the blob is.
Every record is sealed before it leaves the device, and the server has no key to open it.
We say “encrypted”, not “invisible” — a log of when and from where is still a log.
The one moment it’s readable
To describe a document, a model has to read it. That is unavoidable, and it is the single exception to everything above.
It runs under an enterprise agreement with zero data retention: the copy is not stored after the answer comes back, and it is never used to train models.
The copy goes straight from your device to the model provider — it never passes through Enqlave’s servers, and we keep no copy.
What comes back — summary, labels, embeddings — is encrypted on your device before it is stored.
Search never leaves home
Every client decrypts locally. The index lives on your device, not on a server.
Keyword and semantic search run entirely on the machine in your hands — nothing is sent anywhere.
Only when you ask a question does a short, summarized slice of the relevant documents go out, so the model can compose an answer.
Where this is going
As laptops and phones get faster, more of this work moves on-device — and the one readable moment shrinks toward zero.
Today Enqlave uses frontier models because they give you materially better answers, and we would rather be honest about that
trade than ship a worse product and call it privacy.