[porcellus]

Hi, one of the devs here working on ZeroKit. We encrypt everything on the client, so the it is end-to-end encrypted. We only store the private keys on our servers in an encrypted form. The server only provides ACL (so users don't get access to encrypted data they shouldn't, even if they wouldn't be able to decrypt it), checks the password using SRP-6a and provides OpenId Connect that realm uses to authenticate the users

[marknadal]

Thanks for the more info.