osFoundry / Platform
End-to-end encryption
Workspace keys never leave your devices. Server sees ciphertext only.
What it is
End-to-end encryption in osFoundry means your workspace is encrypted on your device before anything is synced, and the keys that unlock it never leave the devices you control. The server stores and moves ciphertext; it does not hold the material needed to read it. This is the encryption model people mean when they ask whether a vendor "can see my data" — the honest answer here is no, because the plaintext and the keys stay on your side.
Inside osFoundry this fits the local-first architecture rather than fighting it. osFoundry is a bring-your-own-key desktop workspace: you connect your own model API keys, your data can stay on your device, and there are no per-seat fees or reseller markup. Encryption follows the same principle. Your chats, agent runs, notes, code, and knowledge are encrypted client-side, and when a workspace syncs across your own devices it travels as ciphertext that only your keys can open. Because the server never possesses your keys, a breach of the server, a subpoena to the vendor, or an operator with database access yields ciphertext, not your work. That also means recovery is your responsibility: if you lose every device holding a key and have no backup of it, no one at osFoundry can restore access — the same property that keeps the vendor out keeps a lost key permanently locked.
This matters most when the workspace holds things you cannot afford a third party to read: source code and API credentials, customer records, legal or financial documents, or the prompts and outputs of agents working over sensitive material. Combined with BYOK models and the option to run local or self-hosted inference, end-to-end encryption lets you use modern AI without accepting that a SaaS provider silently becomes a copy of everything you touch.
Key capabilities
- Workspace content is encrypted on your device before it syncs; the server stores and transmits ciphertext only
- Workspace keys never leave the devices you control — the vendor holds no key material to decrypt your data
- A server breach, insider with database access, or legal demand to osFoundry surfaces ciphertext, not plaintext
- Encryption follows the local-first, BYOK model: your data can stay on your device and your model keys stay yours
- Because keys are yours alone, recovery is yours too — keep a key backup, since a fully lost key cannot be restored by osFoundry
Use cases
- Developer: keeps a workspace of source code, .env secrets, and API keys in AI-assisted chat without exposing them to the vendor's servers
- Legal or finance professional: runs agents over contracts and financial records knowing the plaintext and keys stay on their own devices
- Privacy-conscious team: syncs one encrypted workspace across their own laptops and desktop while the server only ever handles ciphertext
Frequently asked questions
Can osFoundry read my workspace data?
No. Content is encrypted on your device before syncing, and the keys that decrypt it never leave your devices. The server only ever sees ciphertext, so osFoundry has no key material to read your workspace.
What happens if I lose the device with my key?
Because the keys are yours alone and osFoundry never holds them, no one at the vendor can recover a workspace once every device holding its key is gone. Keep a backup of your key — the same property that locks the vendor out will lock you out if the last key is lost.
How does end-to-end encryption relate to BYOK and local-first?
They're the same principle applied throughout osFoundry: your model API keys stay yours (BYOK), your data can stay on your device (local-first), and your workspace keys stay on your devices (end-to-end encryption). The server is a ciphertext relay, not a vault that can see inside.