Tier 1 · Managed cloud
Managed, with hybrid encryption
Hosted by us with hybrid encryption: secrets are scrubbed before upload, files are encrypted at rest, and you can lock storage to zero-knowledge.
- Secrets and keys are scrubbed in your browser before upload
- Sanitized text is distilled in server memory; staged uploads are deleted after each job (sources waiting for more tokens are kept encrypted for up to 7 days)
- Optional passphrase lock: zero-knowledge storage at rest (AES-256-GCM, PBKDF2)
- Envelope encryption at rest keeps MCP-connected vaults usable