Sealed ciphertext store

The Reliquary

The Reliquary keeps documents as sealed text: every field is encrypted on your side before it reaches Zipper, under its own per-document key that is wrapped by your workspace key (AES-256-GCM). Queries still work because rows are found by blind equality tokens — a keyed fingerprint of the value, never the value itself — and range lookups bucket the token so a search stays coarse. A custodian seal lets a named, logged, time-boxed key open a record when you must, and key rotation runs in the background, resealing old keys as it passes. The Studio view shows sealed columns as ciphertext — a zero-knowledge display, not zero-knowledge execution. Honest limits, stated plainly: access patterns leak (row counts and timing survive encryption), blind indexes serve equality and coarse ranges only — no arbitrary joins or ordering over sealed columns — and zero-knowledge is a direction, not a promise. Not SQL Server Always Encrypted, not a confidential-compute cluster, and not a secrets vault — this is your document store with the operator locked out of the contents.

In plain English — A document store that seals every field before it leaves your app: we keep text we cannot read, and blind match tokens still let your queries find the right rows. Only your key opens it.

• ▸ Field-level envelope encryption before upload
• ▸ Blind equality and coarse range indexes
• ▸ Zero-knowledge Studio view of sealed columns
• ▸ Custodian seals — named, logged, time-boxed
• ▸ Background key rotation
• ▸ Honest limits stated in the copy

Auto-provisioned on every new zone. Read the The Reliquary docs, including use cases and API examples. Manage it from the dashboard after you create an account.