Where the build is stored

One runtime, one encryption model, one set of features. The one thing that differs between accounts is where the encrypted build is stored — not how strongly it is protected.

Your code is AES-256-GCM encrypted in both configurations, everywhere it rests. Engine-only storage does not mean plaintext on your server. It means the ciphertext lives on your machine instead of ours. The encryption is identical, the key handling is identical, and nothing readable is written to disk in either case.

The one architectural difference

Engine-only — stored on your server

Once a server confirms it holds a verified copy of a build, the central copy is dropped. The AES-256-GCM encrypted artifact then lives on your own machine and nowhere else.

LockFlare holds no copy of your build. That is a stronger privacy position, not a weaker one.

Cipher repositories — stored centrally as well

The AES-256-GCM encrypted artifact is retained centrally and versioned, in addition to being delivered to your servers.

A server can be rebuilt from that copy at any time, and a build can be promoted between environments without being pushed again.

What that changes in practice

	Engine-only	Cipher repositories
Encryption of the build	AES-256-GCM	AES-256-GCM
Plaintext written to disk	Never	Never
Runtime, isolation, Enclave	Identical	Identical
Where the ciphertext rests	Your servers only	Cipher repositories + your servers
Promote a build between environments	Push again	Repoint — no bytes move
Rebuild a lost server from a stored copy	Push again from your source	Pulls its artifacts and resumes

The two consequences at the bottom of that table both follow from the same fact: with engine-only storage there is no central artifact to promote or to restore from, because it was deliberately dropped once your server confirmed it had one.

With engine-only storage, your server holds the only copy of that build. If it is lost and you have not backed it up, push again from the machine that still has the source. That is normally a minor inconvenience — you keep your source and your build outputs either way — but it is worth knowing rather than discovering.

A third place: storage you run

For regulated workloads the encrypted builds, variables, version history and project metadata can live in storage you operate inside your own perimeter, and LockFlare leaves artifact custody entirely. It is arranged per deployment; see data sovereignty.

Capacity

Separate from storage, and licensed on four axes agreed per deployment:

Servers — each registered machine running an Engine.
Cores — CPU cores allocated across all servers. You choose the split per machine.
Seats — team members who can sign in to Cipher.
Environments — Development, UAT, Live, and any others you define.

Cipher shows all four as live gauges on the Licensing screen, so you can see how close to a ceiling you are before you hit it. See Licensing.

Changing storage or capacity does not change your projects, servers or environments. Adding capacity raises the ceiling; nothing is migrated and nothing is redeployed.

Understanding a LockFlare server Licensing