"client-side encryption" mode