Key Highlights
- Sensitive vault payloads are intended to remain encrypted outside the client trust boundary.
- Authentication and metadata APIs process only what is required for account and sync functionality.
- Deployment owners control infrastructure location, storage provider, and retention settings.