If your studio works under NDA, this is the page that decides whether Ceyu is usable at all. It is written to be checkable rather than reassuring.
Boards and projects are written to your own disk, in your user profile directory, and read from there. That is the primary copy — not a cache of a server-side original.
The consequences are the useful part:
Sync is opt-in. With it on, your boards are available on your other devices and to the people you collaborate with in real time.
The encryption key is generated on your device and is never sent to the server. Content is encrypted before upload and decrypted after download. What the server stores is ciphertext it has no key for.
The distinction worth holding onto: this is not a promise not to look at your data. It is an inability to.
Where the boundary is
End-to-end encryption covers board and workspace content. It does not cover account data — your email address, organisation membership, role, billing reference — or the metadata sync needs to function, such as room identifiers and revision numbers. Those are ordinary processed data and are described in the privacy policy. Anyone claiming otherwise about any product is overselling.
Changes made without a connection are queued locally and reconciled when the connection returns. Most concurrent edits merge cleanly because they touch different objects.
Where a merge would not be safe, Ceyu keeps both versions and says so, rather than picking one silently. Combined with version history that means a bad reconciliation is recoverable, which a “last write wins” rule would not be.
An individual can simply leave sync off. For an organisation that is not good enough, because it depends on every person getting it right.
A workspace admin can set a local-only storage policy. It applies to everyone in the workspace and disables cloud sync as a matter of configuration rather than habit. This is the setting to use when a contract says material may not leave your machines.
The trade-off is real and worth stating: with local-only in force, real-time collaboration and share links are not available, because both require the server.
Boards and projects can be exported. Because the local copy is the primary one, an export is a convenience rather than the only route out — the files are already on your disk.
For a full copy of the personal data held about you, use the data request page.