Each container is a fully encrypted virtual desktop backed by SafeNova EFS. Every file gets its own AES-256-GCM key and a unique IV — data at rest is indistinguishable from random bytes. Passwords are never stored: Argon2id derives a 256-bit key in memory, resistant to GPU and ASIC brute-force by design. Nothing leaves the browser — keys live only in volatile session memory and vanish on inactivity or tab close.