Files are encrypted in this browser before upload. The server only ever receives ciphertext.
How this works: a one-time AES-256-GCM key encrypts your file in the browser,
then that key is wrapped with the vault's RSA public key. Only the private key on the
surf server can unwrap it. Nothing readable leaves this device.