What is Enclave?
Enclave is a secure collaboration platform for teams that handle sensitive data. Files are encrypted with AES-256-GCM using keys you control (your KMS/HSM). For the strongest guarantee, Zero-Knowledge and ZK-Strict rooms encrypt on your device and store only ciphertext Enclave cannot read — not even if compelled.Quickstart
Get your team into Enclave in under 10 minutes.
Core Concepts
Understand rooms, encryption, and access control.
Deployment
Run Enclave as SaaS, private cloud, on-premise, or air-gapped.
Key Management
BYOK, HYOK, and HSM integration.
Security & Trust
Architecture, cryptography, and our zero-knowledge design.
The security guarantee
Most security products make an operational promise: “we won’t look at your data.” Enclave lets you choose an architectural one.- Keys you control (BYOK/HYOK) — the master key that wraps your data lives in your own KMS or HSM. Kvelden never stores it in plaintext. Enclave decrypts server-side only to serve your downloads and the workflows you enable (DLP, signing).
- Zero-Knowledge & ZK-Strict rooms — files, chat, and secrets are encrypted on your device; the server stores only ciphertext and holds no key that can decrypt it. Even under legal compulsion, Kvelden cannot decrypt this content — there is nothing to hand over. ZK-Strict additionally disables every server-side workflow that would need plaintext.
Who uses Enclave?
Enclave is built for teams where data sensitivity is non-negotiable:- Legal & M&A — secure deal rooms for due diligence, NDA-protected document exchange
- Financial services — encrypted collaboration meeting SEC, FCA, and MiFID II requirements
- Healthcare — HIPAA-compliant file sharing without trusting cloud provider staff
- Government & defence — air-gapped deployment, HSM-backed key management
- Enterprise IT & security — SOC 2 Type II and ISO 27001 aligned operations
Compliance posture
Have a question not covered in these docs? Email us at hello@kvelden.com — every message is read by an engineer.