Sensitive patient, clinical, and financial field values are encrypted on-device before storage and sync. Maestra’s database stores ciphertext for those values and never receives the unwrapped data key.
Zero-knowledge describes this stored-data boundary. It does not mean that every feature runs without transient machine processing. Transcription, generated notes, assistants, patient import, assistant retrieval, and PDF rendering send the necessary request payload through the Maestra relay and relevant contracted processor.
The encryption password travels over an authenticated TLS unlock request so the account can be verified and its wrapped key material returned. On-device code derives the master key and unwraps the data key locally. Maestra does not store the plaintext encryption password.
The unwrapped data key remains device-held. Maestra stores the password-wrapped and recovery-wrapped forms required for unlock. It also stores an encrypted recovery-key backup that an unlocked installation can reveal after encryption-password verification. Maestra cannot read that recovery key.
Maestra keeps the minimum readable metadata needed to coordinate the service: account identity and profession, entity and relational IDs, encounter dates and times, status, attendance, consent-attestation timestamp, subscription state, and other non-sensitive coordination fields. See the detailed data inventory.
flowchart LR
Device["Unlocked device\nDecrypts and encrypts locally"]
Relay["Maestra relay\nRequest-scoped processing\nNo clinical payload logging or retention"]
Processors["Contracted processors\nNecessary audio, text, images, or documents"]
Database["Maestra database\nCiphertext for sensitive fields\nReadable structural metadata"]
Device -->|Necessary plaintext request payload| Relay
Relay -->|Task payload| Processors
Processors -->|Task result| Relay
Relay -->|Result| Device
Device -->|Ciphertext plus structural metadata| Database
The relay handles readable content in memory for the request. It forwards audio for transcription and speaker processing, text for note and assistant tasks, source text or images for import parsing, text for embeddings and retrieval, and clinical HTML for PDF rendering. It does not log or retain the clinical payload. Contracted processors receive only what their task requires under the safeguards described in Sub-processors.
