Skip to main content
Prem API uses end-to-end encryption (E2EE) to make sure that your data stays private and secure. All encryption occurs on your device. Your plaintext data does not leave your device without encryption. Prem cannot read your data.

​
Zero-Knowledge Architecture

The platform operates on a zero-knowledge principle:

Client-Side Encryption

Your device encrypts all data before transmission

No Plaintext Access

The servers see only encrypted data, never your actual data

You Control the Keys

You generate the encryption keys, and you store them only on your side

Post-Quantum Security

The encryption protects your data against current threats and future quantum computing threats

​
How It Works

The encryption architecture uses a two-server model for defense in depth:

​
Prem API Gateway vs Prem API Enclave

The Prem API Gateway is a secure gateway that never has access to your plaintext data. It only sends encrypted payloads forward to the Prem API Enclave. If an attacker gets control of the Prem API Gateway, the attacker sees only encrypted data.
The Prem API Enclave operates in a Trusted Execution Environment (TEE). A TEE is an isolated environment with hardware protection. In the TEE:
  • Decryption occurs in a secure environment
  • Processing occurs in full isolation
  • The enclave encrypts the responses before the responses leave
  • Server operators cannot access the plaintext, because no operator access mechanism exists in the images

​
Key Types

  • Key Encryption Key (KEK): Your master key (32 bytes). It protects all other keys. It does not leave your device without encryption.
  • Data Encryption Key (DEK): A unique key for each file (32 bytes). Each file gets its own key for isolation.
  • RAG DEK: A persistent key (32 bytes). The system uses it for encrypted document search operations.
  • CONNECTOR DEK - A persistent key (32 bytes). The enclave uses it to decrypt connectors.
  • KID (Key Identifier): The system derives the KID from your KEK. The KID identifies your keys on the server and does not show the KEK.
Your master key (KEK) does not leave your device without encryption. The SDK wraps the file keys (DEKs) with your KEK before transmission. The server stores the RAG DEK wrapped with your KEK. For RAG operations, the SDK encrypts the file DEKs and the RAG DEK with a temporary shared secret from the XWing key exchange. Then the SDK sends these keys to the enclave.

​
Cryptographic Algorithms

Prem API uses modern, proven cryptographic algorithms:

​
Post-Quantum Security with XWing

XWing is a hybrid key encapsulation mechanism. It combines two algorithms for maximum security:
  • ML-KEM768 (Kyber): A NIST-standardized quantum-resistant algorithm
  • X25519: A proven elliptic curve algorithm
This hybrid method makes sure that your data is safe against current attacks and future quantum computers. If an attacker breaks one algorithm, the other algorithm keeps your data secure.
Sufficiently powerful quantum computers will break traditional encryption, for example RSA and standard elliptic curves. XWing protects against “Harvest Now, Decrypt Later” attacks. In these attacks, adversaries store encrypted data today. They decrypt the data when quantum computers become powerful.

​
File Encryption

Each file that you upload goes through a secure encryption process:

​
Encryption Process

1

Generate the file key

The SDK creates a unique random 32-byte key for this specific file
2

Encrypt the content and metadata

The SDK encrypts the file content and the metadata (filename, type) with XChaCha20-Poly1305
3

Wrap the file key

The SDK encrypts the file key with your master key. It uses AES-KWP
4

Upload the encrypted data

The SDK sends only encrypted data and wrapped keys to the server

​
Decryption Process

When you get a file:
  1. Download the encrypted file and the wrapped key from the server
  2. Unwrap the file key with your master key
  3. Decrypt the file content and the metadata

​
RAG Encryption

For encrypted document search, Prem API uses a secure key exchange scheme. This scheme permits AI-powered search and keeps your data private:

​
How RAG Search Works

1

Key Exchange

When you index files for search:
  • The XWing key exchange establishes a shared secret with the enclave
  • The SDK encrypts the file key (DEK) with the shared secret
  • The SDK encrypts the RAG key with the shared secret
  • The SDK sends both encrypted keys to the enclave
2

Search Query

When you search:
  • The SDK encrypts your query on your device
  • The SDK establishes a new XWing key exchange
  • The SDK sends the encrypted query to the enclave
3

Secure Processing

Inside the secure enclave:
  • The shared secret decrypts the RAG key and the file keys
  • The enclave decrypts the applicable documents with their file keys
  • The enclave searches the documents in isolation
  • The enclave encrypts the results before the results leave
4

Results

The enclave sends the encrypted results back to your device. Your device decrypts the results locally
The Prem API Gateway never sees your search queries or your document contents. All processing occurs in the isolated Prem API Enclave.

​
Secure Key Exchange

For chat completions and tool operations, the SDK establishes secure communication with the XWing key exchange:

​
Best Practices

Secure Your Master Key

Store your master key (KEK) securely and keep backups. The KEK is critical.

Regular Backups

Make backups of your keys in multiple secure locations. If you lose your master key, you lose your data permanently.

Never Share Keys

Do not share your encryption keys. Do not transmit them in plaintext.

Verify Integrity

The system verifies data integrity automatically. Examine all authentication errors.