Following up on the launch thread, few of you asked same good question:

transcript is immutable and redaction happens at share boundary, but doesn't local index still hold plaintext secrets at rest, so any agent/MCP client with read access (or synced backup) can pull old key straight out of search?

it is a logical deduction. scritty's model is not "your disk is the trust boundary." instead there's opt in at rest encryption on the local store one switch, pointed at a passphrase you hold (env var or OS keychain, never written to config) and the whole local store is encrypted, both layers, not just the transcript:

1. relational transcript + keyword index (SQLCipher): page level AES 256, each page authenticated with an HMAC so tampering is detectable, key stretched from the passphrase via PBKDF2.

2. vector index: XChaCha20 Poly1305 authenticated encryption, key derived via Argon2id, KDF params + salt bound as AAD. same passphrase as layer one so an old key buried in history isn't readable by another process, MCP client, or synced backup without it. fail closed -- passphrase absent > the store refuses to open, never a silent fallback to plaintext.

3. scope gating: per client. MCP access is by scoped token; hand an agent a token bound to a specific session (or set), and it can't widen to the whole corpus. cross corpus reads (e.g. corpus wide semantic search) are refused for that token, not silently honored. "one agent asking for everything" only works if you explicitly mint it admin scope.

Thanks for the welcome on launch day! Appreciate the warm reception an insightful questions. A few clarifications on the most common asks + some onboarding updates:
Pricing: https://scritty.dev/#pricing - self serve individual and team pilot licenses are now live!

Personal Pilot (direct): https://buy.stripe.com/00weV56jD...

Team Pilot (direct): https://buy.stripe.com/4gM00b4bv...
Enterprise (k8s/managed deployments) isn't self serve as it needs a bit of setup on our side, so please reach out directly and we'll get you going
Personal + Team, you're up and running in under 5 minutes on the embedded backend -- install the binary, drop in your license key, and go.
You can also hook up your own backend (qdrant/pgvector/chroma/weaviate), and our team is happy to help with that or point you at the docs.

Enterprise is our hybrid and fully air gapped options; this has variable setup time, driven mostly by your security posture, networking, and existing infrastructure. Assuming right internal resources are engaged with our onboarding team, it's typically stood up and validated within one work day.