> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enclave Overview

> Encrypted collaboration with keys you control and zero-knowledge rooms, for teams that handle sensitive data.

## What Enclave does

Enclave gives your team a secure space to share files, collaborate on documents, and manage sensitive data — without trusting the platform to protect it. The encryption guarantee is architectural, not contractual.

## How it works

<Steps>
  <Step title="User uploads a file">
    The Enclave client generates a unique DEK (data encryption key) for the file using a cryptographically secure random number generator.
  </Step>

  <Step title="Client-side encryption">
    The file is encrypted with AES-256-GCM using the DEK before any data leaves the user's device.
  </Step>

  <Step title="Key wrapping">
    The DEK is wrapped (encrypted) using the room's KEK (key encryption key), which is derived from your KMS or HSM.
  </Step>

  <Step title="Ciphertext upload">
    Only ciphertext reaches the Enclave server. The server stores encrypted blobs — it cannot read them.
  </Step>

  <Step title="Authorised download">
    When a room member downloads a file, the client retrieves the wrapped DEK, unwraps it via the KMS, decrypts the file locally, and presents the plaintext to the user.
  </Step>
</Steps>

## Key capabilities

| Capability     | Detail                                    |
| -------------- | ----------------------------------------- |
| Encryption     | AES-256-GCM, client-side                  |
| Key management | BYOK, HYOK, HSM (Thales, AWS, Azure, GCP) |
| Access control | Org Unit membership + clearance levels    |
| Audit logs     | Append-only, cryptographically signed     |
| Deployment     | SaaS, VPC, on-premise, air-gapped         |
| Compliance     | SOC 2 Type II, ISO 27001, GDPR, HIPAA     |

## What Kvelden cannot do

* **Read content in Zero-Knowledge / ZK-Strict rooms** — keys live only on your devices; the server holds no key that can decrypt it, so there is nothing to hand over even under a decryption order.
* **Modify your audit logs** — entries are cryptographically hash-chained and signed.
* **Grant access to your rooms** — access is enforced by key material, not policy alone.
* **Hold your master key in plaintext** — with BYOK/HYOK it stays in your KMS/HSM.

<Info>
  Personal files and Standard (Envelope) rooms are encrypted with a key you
  control, but Enclave **can** decrypt them server-side to serve your downloads and
  the workflows you enable (DLP, signing). Only **Zero-Knowledge and ZK-Strict
  rooms** are undecryptable by the server. In self-hosted / appliance deployments
  Kvelden operates nothing and has no access at all.
</Info>