frame candidate goes to: this-edition A all three

Encryption on the client moves the problem from the data to the keys, and the sovereignty line to whoever holds them

When the server can read what it stores, all of it has to be protected: every copy, backup, log and replica, and every person and process with access. When the server holds ciphertext named by the hash of that ciphertext, the problem moves to protecting the keys, which is much smaller, and the key becomes the whole question: where it is kept and how it travels decides who can read, who can write and what a leak costs. The sovereignty line stops being where the data is stored and becomes who holds the keys, so data can sit with a provider or in a country with sovereignty gaps and you remain sovereign over it and able to move it; the European Data Protection Board treats strong encryption with the keys retained solely by the exporter as an effective supplementary measure for transfers.

Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).

Note. The EDPB source is Recommendations 01/2020, version 2.0, 18 June 2021, use case 1, quoted in the article: 'the EDPB considers that the encryption performed provides an effective supplementary measure.' The same idea as sovereignty as the ability to move (hack-your-country). The cost of the design, from the keys article: everything that matters is in the key, which is why key management is where the effort goes now.

Where it comes from

• The value of constraints From the data to the keys (newsroom)
• Where the vault keys live In short; Where everything lives (newsroom)

What it answers in the 2018 book

• none named

Where it goes

Chapter Privacy by design: SG/Send, sgit, and the value of constraints, part Build it without a server (drafting); topic Building blocks: cloud, serverless, free models, git and CI.

Other ideas proposed for the same chapter: Git for things you cannot put on GitHub: what an encrypted vault is, One string is address, authorisation and key; the read key derived from it is safe to publish, An app in a vault runs against the vault without ever being handed a key, Where the keys live: a password manager for the keys a person holds, a registry vault for the keys agents make, Append lanes: one POST from anywhere, readable only by the vault's owner, Nobody buys it for the encryption: the features came from the constraint, Client-side encryption reduces the exposure under GDPR; it does not take you out of it.

Node idea:protect-the-keys-not-the-data in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.