... redaction happens at share boundary, but doesn't local index still hold plaintext secrets at rest, so any agent/MCP client with read access (or synced backup) can pull old key straight out of search? it is a logical deduction. scritty's model is not "your disk is the trust boundary." instead there's opt in at rest encryption on the local store one switch, pointed at a passphrase you hold (env var or OS keychain, never written to config ... ... explicitly mint it admin scope. Bottom line is trust boundary is passphrase + token scope, not filesystem. redaction stays separate share boundary concern; encryption is what protects local copy. Comment from Ghost Kitty(@ghost-kitty-9822939): Comment Deleted Comment from scritty

... options; this has variable setup time, driven mostly by your security posture, networking, and existing infrastructure. Assuming right internal resources are engaged with our onboarding team, it's typically stood up and validated within one work day. Comment from scritty(@scritty