Sensitive fields and documents stay on the device until you send them.
Swiss-hosted. Layered protection.
Swiss cloud.
Or your infrastructure.
Your sensitive work stays in Switzerland, encrypted in the browser, on the wire, and at rest — with iown holding the infrastructure keys. Prefer your own servers? We can deploy there too.
Encrypted on the way to Switzerland. Nothing travels in the clear.
Double-encrypted in Switzerland North with iown-managed keys.
+Azure · Switzerland NorthOwn infrastructure on request
Technical detail
How protection is layered on the hosted platform.
Notes for security and infrastructure reviewers. Client-side vault encryption is a separate control from infrastructure encryption at rest.
Selected sensitive fields and documents are encrypted in the browser before they leave the device. Unlock keys are user-controlled; iown cannot recover a lost vault key. This layer is independent of cloud encryption at rest.
Infrastructure CMK, double encryption and encryption-at-host address data at rest and key control; confidential compute covers data in use. Client-side vault encryption remains a separate layer for selected fields and documents. Full inventory: Security architecture.