Per-account encryption
Each account will have its own encryption boundary, instead of the service holding what unlocks all stored content.
Your data
Your work is yours. Here is where it lives.
Who owns it, who could read it today, and what we are building next — in plain words.
You own it.
Everything you put in, and everything the workers make for you, is yours. We do not own it and we do not sell it.
It lives on machines we run in the United States.
One machine serves the product and holds the record. Verified copies sit on our other machines.
What we can and cannot read today.
Today, we hold what unlocks stored content on our machines. That means the people who run the service could read it.
Every account made by sign-up or invite is private. The product walls one account off from another, and the operator's own sign-in stops at those private accounts. Those walls limit what the product lets us open; they do not change the fact that we hold what unlocks the stored content.
What is planned.
These are planned, with no date. We would rather say where they stand than turn a plan into a promise.
Planned
A local desktop mode
A way to run Productivity Sweet locally, so the work can stay on your own computer.