Every file is encrypted the moment it's stored

Files are encrypted at rest from the instant they arrive, and only decrypted for a verified, passkey-authenticated recipient at the moment they view it. Nobody — not an attacker with server access, not a curious third party — can read a stored file without passing that same device check the real recipient had to pass.