Where your data is stored, and what is encrypted

The honest version of this answer has two halves, and skipping the second one would be misleading.

What the service cannot read

Content covered by a policy is encrypted before it reaches hosted storage. The hosted service holds ciphertext for those paths and has no key for them. This is the property TOVIO exists to provide, and it holds on hosted storage exactly as it holds on a laptop. No plan tier changes it, and no administrator role bypasses it.

What the service can read

Not every hosted datum is ciphertext. The following follow their documented trust boundary rather than being encrypted from the service:

• public repository content

• repository metadata

• identity and policy metadata

• billing records

• plaintext deliberately disclosed to an entitled client, CI runner, or model

Add to that the collaboration layer the hosted app puts around a proposal: its title, its description, its comments, and who was asked to review. That prose is service data, not sealed content, and it is readable by the service. The composer warns you when the proposal touches a policy-protected path — but a warning is not encryption, and no scan is a substitute for not pasting a secret into a review thread in the first place.

Your account record and preferences are sealed at rest.

The practical rule

A repository name, a lane name, a proposal title, and a policy's shape are all metadata. Do not encode a secret in one. Protect the file, not the filename.

What the anonymous surface shows

Nothing protected, ever. On a published repository, a policy-protected path appears as metadata with a protection marker or is left out entirely; the edge holds no recipient key and does not decrypt. The signed-in application may show a protected path as redacted with its sealed address, so your own client can unseal it locally — which is a different thing from the service reading it.

Tenancy

Free, Personal and Business run on shared infrastructure. Enterprise is a shared isolated tenant. Dedicated tenancy is available as an add-on with the Enterprise plan, along with the 99.99% availability commitment.

Regions and residency

Specific hosting regions and any residency guarantee are not published as part of the launch catalog, and geographic data-residency guarantees are explicitly out of scope for the first enterprise release rather than merely undocumented. If your organization has a residency requirement, treat it as an open question to raise before committing — we would rather answer it directly than have you infer it from where a request happens to be served.

Where this is documented properly

The threat model on the documentation site is the authoritative statement of what TOVIO defends against, including the residual risks that are accepted rather than solved. It is worth reading before a procurement decision, and it is deliberately not a marketing document.