enVector — Confidential cloud storage and retrieval for sensitive embeddings

To use AI on your data, you first have to embed it — and then you have to put those embeddings somewhere. Somewhere searchable. That “somewhere” is where the whole architecture of a modern AI system quietly gets decided, and where, if your data is sensitive, you run into a wall.

The wall usually gets framed as a location question: on-prem or cloud? But that’s the wrong question. The real question is who you have to trust with your plaintext — and every standard answer forces you to trust someone. That’s the tradeoff most teams accept as a law of nature. It isn’t.

Three ways to store embeddings, three things to trust

Look closely and there are only three conventional options for where sensitive embeddings live. Each one asks you to extend trust somewhere, and each place you extend it is a place that can fail.

Trust yourself — keep it on-prem. You stand up the vector database inside your own perimeter. Nothing leaves. It’s the instinctive answer for regulated data, and it works right up until you count the cost: the cluster, the patching, the scaling, the on-call rotation, the capacity planning. You didn’t want to run infrastructure — you wanted to ship a product. On-prem doesn’t remove risk so much as it relocates the entire burden onto your own operations, and operations fail too.

Trust the vendor — put it in the cloud. Hand the embeddings to a managed vector database and the operational headache disappears. But now the provider holds your plaintext — the vectorized shadow of records your customers never agreed to hand to a third party. And embeddings are not the anonymized abstractions they’re often assumed to be. Research on embedding inversion (vec2text and its successors) has shown that the original text can be reconstructed from vectors alone with startling fidelity. So “we only sent the embeddings” is not the safety guarantee it sounds like. What you’ve really done is move the sensitive data one layer over and trust someone else to guard it.

Trust the hardware — use a secure enclave. The confidential-computing pitch is that a trusted execution environment (TEE) keeps data protected even in memory, so the cloud provider can host it without reading it. It’s a real improvement over plaintext-in-the-clear. But the trust hasn’t disappeared — it’s been moved into silicon. You’re now trusting the chip vendor’s enclave implementation, its attestation chain, and its resistance to the steady drip of side-channel attacks that researchers keep finding. Hardware trust is still trust. It’s just harder to see.

Here’s the part that catches people off guard: standard encryption doesn’t rescue any of this. Encrypt the index at rest and you’ve protected it beautifully — until you need to search it, at which point it has to be decrypted back into plaintext to be read. Even customer-managed encryption keys don’t change the physics: the key exists so the data can be decrypted, and at search time, it is. Encryption plus search, done the ordinary way, means decryption. That’s the gap.

What this actually costs you

If you build AI over customers’ sensitive data — in finance, in legal, in healthcare — you’re not just running a system. You’re a custodian. The plaintext you’re responsible for is a plaintext you often can’t afford to expose to a third party, sometimes as a matter of contract, sometimes of regulation, sometimes of both.

That puts you in a bind. Keep everything in-house and absorb an operational burden that has nothing to do with your actual product. Move to the cloud and expand the circle of parties who can read — or be compelled to read, or be breached into revealing — data that was never theirs to see. Reach for an enclave and shift your bet onto a hardware root of trust you can’t audit. None of these options is obviously right, which is exactly why the decision tends to stall.

How enVector removes the tradeoff

enVector breaks the choice by removing its premise. It’s built on CKKS homomorphic encryption — the scheme invented by CryptoLab founder Professor Jung Hee Cheon — and it runs similarity search directly over ciphertext. Your embeddings are never decrypted: not at rest, not in transit, and not during the search itself. The index is computed while it stays encrypted.

Walk it back through the three trust models and watch each one dissolve:

• You don’t have to trust yourself with the ops. enVector is a fully managed service — no cluster to stand up, no patching, no capacity planning. And it’s cloud-neutral: it runs across the major clouds (AWS, GCP, Azure, OCI), so it fits the environment you already have rather than dictating one. You deploy in minutes and operate a product, not an infrastructure.
• You don’t have to trust the vendor with your plaintext. The storage layer literally cannot read your data, because it never receives your data in readable form. Provider-blind isn’t a policy promise here; it’s a property of the math. Even under breach or legal compulsion, there’s no plaintext to hand over.
• You don’t have to trust the hardware. Confidentiality rests on cryptography, not on an enclave you can’t inspect. There’s no attestation chain to verify and no side-channel surface to worry about, because the protection doesn’t depend on the chip keeping a secret — it depends on a problem that’s computationally infeasible to solve.

That’s the difference in one line: cryptographic trust, not custodial trust and not hardware trust. You’re no longer trusting a party or a processor to behave. You’re trusting a theorem.

“But homomorphic encryption is too slow”

This is the objection everyone brings, and for years it was fair. It isn’t anymore. enVector runs similarity search over encrypted vectors in real time, works with any embedding or generation model — your stack stays your choice — and is fast enough to sit in a live retrieval path rather than a research demo.

You don’t have to take that on faith. There’s a live demo at heaan.land where you can run encrypted search yourself and watch the latency, and the service starts at $0.01/hour. The point of the demo is exactly this objection: stop imagining the performance and go measure it.

The short version

1. The choice was never really on-prem vs. cloud — it was who do you trust with plaintext: yourself, the vendor, or the hardware.
2. Standard encryption doesn’t help, because searching an encrypted index means decrypting it. Customer-managed keys just relocate that decryption.
3. enVector searches over ciphertext directly with CKKS homomorphic encryption — nothing is decrypted at rest, in transit, or during search.
4. Trust moves from a party to a proof. The storage layer can’t read your data even under breach or compulsion, and there’s no enclave to audit.
5. It’s managed, model-agnostic, and real-time — and you can test the performance objection yourself before writing a line of code.
   

——————————————

enVector is confidential cloud storage and retrieval for sensitive embeddings — managed vector search that never sees your plaintext, running across the major clouds. It’s now available on the Google Cloud Marketplace, so you can deploy it and bill usage straight through your existing Google Cloud account. Try the live demo at heaan.land and get started for $0.01/hour.