Saved agent history encryption

Saved Complexity conversations follow the optional owner policy that administrator groups can require for email data. A normal chat uses the Better Auth actor as owner. An automatic-reply case and its fork use the verified mailbox owner's key. See key setup.

Protected content

Encryption covers titles, user and assistant text, reasoning, reference selection, tool input/output, provider history, and durable run-event payloads. The worker clears plaintext search projections. History search checks current authorization, then searches content decrypted in memory.

IDs, routing, usage, fork provenance, and attachment/person/reference metadata remain queryable. Separate uploaded attachment files are outside transcript conversion.

An encryption envelope stores ciphertext and the metadata needed to check and decrypt it. Its binding ties the ciphertext to the owner and chat/message/run/object IDs. See key ownership and background-work terms.

A reader rejects ciphertext copied from another chat or run. The private key exists only during a temporary KeyStore memory lease. This is a time-limited permission to use that owner's key. The signed-in actor and the encryption owner can differ for an automatic-reply case.

Durable generated-UI input state in complexity.ui_states follows the same owner policy. Its authenticated binding includes chat, message, tool, output, answer, and UI revision identity. Conversion and opt-out also cover retained older revisions.

Reads, writes, and lock

A completed assistant reply or tool result can use the public key for storage without an active private-key lease. History reads, replay, and model-context preparation need a lease.

On lock, Complexity clears message, editor, and artifact state. Late responses cannot restore locked content. The history list uses the generic title Encrypted chat.

Existing content

The managed conversion inventory includes actors without mailboxes. Sync Center reports chat title, message, provider, and event counters during conversion. Folder, rule, description, and chat lineage remain. No email repull or reset is necessary.

This is server-assisted encryption. KeyStore and authorized model execution can read plaintext in memory. The selected model provider receives the required context. Historical object versions, backups, and broker retention remain separate.