Encryption

An authorized Host can read your data. It decrypts workspace content to execute queries, so its operator belongs inside that workspace's trust boundary.

Divide your data economy into as many independently governed workspaces as needed. Each builds on the Solid pod model through LWS, with its own encryption keys, access rules and Host choices. Trusting a provider with one workspace need not expose another.

Keep personally identifiable information, health records or financial data in private workspaces served by your own Host. That Host could run on your laptop or mobile phone. By granting decryption authority only to your own Host, you keep plaintext processing there.

The same application can use other workspaces on other people's Hosts: shared reference data, an organization's records or a service provider's knowledge. Each workspace retains its own trust boundary. Using them together does not require moving your private records to those providers.

For a mortgage discount, let your Host answer an agreed collateral question and return the eligibility result. The worked example follows execution, evidence and disclosure.

Your Host's location does not determine where durable copies live. Encrypted blocks can be held by custodians chosen for price, reliability or retrieval speed. Custody gives them encrypted bytes without the keys to read them.

Set independent replication policies for serving Hosts and encrypted blocks, balancing copy counts, geography, provider diversity and cost.

With enough independent copies and recoverable key material, losing your laptop need not mean losing your health records. Restore access through a replacement Host you authorize. Query service may pause while that Host becomes available; the encrypted data can remain safely distributed throughout.

High availability covers failure domains. Backup and restore covers recovery archives.