Also known as: zero knowledge · client-side encryption
A zero-knowledge architecture is one in which a service provider stores user data but holds no ability to decrypt it, because encryption and key management happen entirely on the user's device.
The design goal is to make the provider structurally incapable of accessing user data, so that a server breach, a rogue employee, or a legal demand yields only ciphertext.
The trade-offs are real: server-side search and processing become difficult or impossible, and account recovery is genuinely hard, since a provider that can restore access to a forgotten password by definition holds a key. Note that 'zero-knowledge' here is distinct from zero-knowledge proofs, a separate cryptographic concept.
End-to-End Encryption
End-to-end encryption (E2EE) is a system in which messages are encrypted on the sender's device and decrypted only on the recipient's, so that no intermediary — including the service provider — can read the content in transit or at rest on its servers.
Encryption at Rest
Encryption at rest is the encryption of stored data — on disks, in databases, or in backups — so that physical access to the storage medium does not yield readable data.
Data Minimization
Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.
Password Hashing
Password hashing is the practice of storing passwords as the output of a deliberately slow, salted one-way function, so that a breach of the credential database does not immediately yield usable plaintext passwords.