What Enclave does
Enclave gives your team a secure space to share files, collaborate on documents, and manage sensitive data — without trusting the platform to protect it. The encryption guarantee is architectural, not contractual.How it works
1
User uploads a file
The Enclave client generates a unique DEK (data encryption key) for the file using a cryptographically secure random number generator.
2
Client-side encryption
The file is encrypted with AES-256-GCM using the DEK before any data leaves the user’s device.
3
Key wrapping
The DEK is wrapped (encrypted) using the room’s KEK (key encryption key), which is derived from your KMS or HSM.
4
Ciphertext upload
Only ciphertext reaches the Enclave server. The server stores encrypted blobs — it cannot read them.
5
Authorised download
When a room member downloads a file, the client retrieves the wrapped DEK, unwraps it via the KMS, decrypts the file locally, and presents the plaintext to the user.
Key capabilities
What Kvelden cannot do
- Read content in Zero-Knowledge / ZK-Strict rooms — keys live only on your devices; the server holds no key that can decrypt it, so there is nothing to hand over even under a decryption order.
- Modify your audit logs — entries are cryptographically hash-chained and signed.
- Grant access to your rooms — access is enforced by key material, not policy alone.
- Hold your master key in plaintext — with BYOK/HYOK it stays in your KMS/HSM.
Personal files and Standard (Envelope) rooms are encrypted with a key you
control, but Enclave can decrypt them server-side to serve your downloads and
the workflows you enable (DLP, signing). Only Zero-Knowledge and ZK-Strict
rooms are undecryptable by the server. In self-hosted / appliance deployments
Kvelden operates nothing and has no access at all.