... constraint. A few things that I think help: Password reset flows preserve data . When users reset their password, their data stays accessible we use password-derived keys with a recovery mechanism that doesn't give us access to the cleartext. Data export, always . Users can export everything at any time. The strongest user protection isn't us holding their data hostage it's making sure they can walk out the door with it whenever they want. Human readable recovery keys ... ... zero-knowledge, which means you hold the key. The customers who choose us choose us partly because of that constraint, not despite it. The worry never fully goes away, but I try to reframe it because what's the alternative