Secure, fast, autonomous: the corpus trilemma

Fully secure, fully autonomous, fully fast: you cannot have all three at once.

Secure, fast, autonomous: what do these three words mean for my intangible capital?

A company's intangible capital is what it knows and what appears on no balance sheet: its strategy, its decisions and the reasons behind them, what it has understood about its customers and competitors, the weak signals its leader picks up before anyone else, the processes nobody has ever written down. Written down, structured and readable by an AI, that knowledge becomes a corpus. And a corpus makes three demands that each pull in their own direction.

Secure: the corpus is encrypted with keys that only the company holds, and that no single person can hand over under pressure. A compromised server, a disloyal employee, a laptop left on a train or a court order yield nothing but noise. To encrypt is to make a text unreadable without a key, a secret its holder keeps on a device or on paper.

Fast: the AI answers and acts right away. Tomorrow's meeting gets prepared overnight, the customer gets served during the appointment, the market gets watched during the holidays, with nobody around to unlock anything.

Autonomous: no trusted third party. Nobody but the company holds the keys or reads the corpus; no provider can read it, cut it off, or hand it to whoever asks.

Pick two, and the third falls. It is exactly the triangle drawn for holding bitcoin, where the intangible capital is capital itself, gone digital; it holds just as well for what a company knows.

• Secure and fast means a trusted third party keeps the keys and unlocks for you. It is today's model: your documents with a large provider, encrypted by them, read by their AI when you ask, and by them when they decide. You are not autonomous. In Bitcoin, this is the custodian: the platform that holds your bitcoin and shows you a balance.
• Secure and autonomous means the keys are spread out and nothing opens without humans. The agent waits to be let in; it does not work at night. In Bitcoin, this is multisig across three distant locations: several keys, so several people, to spend.
• Fast and autonomous means everything is readable locally, behind a single key or a plain password, and security has dropped: the stolen laptop takes everything, and so does the employee who leaves. In Bitcoin, this is a single key on a single device.

The corner most companies sacrifice today, they sacrifice without knowing it: autonomy. Their provider told them their data was encrypted, and it is true. You have to look at what “encrypted” means when someone else holds the key.

My provider says my data is encrypted: against what?

The word “encrypted” covers three levels, and they do not protect against the same things.

At the first level, data is encrypted “at rest” by the hosting provider: on its disks, with its keys. It is real protection against a disk stolen from a data centre, and Google says so of its own default encryption: it owns and manages the keys. Against access to the database, an employee of the provider or a request from the authorities, this level protects nothing: the database opens for anyone entitled to query it.

At the second level, data is encrypted by the application server, with the keys stored separately. A copy of the database or a leaked backup contains only noise. But the server itself can decrypt: that is its job. An attacker inside the application reads what the application reads, and so does the provider. This level is not “plaintext”: it is encrypted, yet readable by the server, and that is precisely what lets the provider's AI work fast on your documents. Confidential computing, a more recent variant, runs that computation inside a processor enclave the host itself cannot read: the trusted third party changes nature, it is now the chip maker, but it does not go away.

At the third level, called “zero-access”, only the company holds the key. The private key never leaves the customer's device; the server stores and forwards, but cannot read anything, and therefore cannot compute anything. Proton, which built its mail service on this principle, puts it simply: because the server does not have the private key, the provider cannot read the data it stores.

The first two levels are the trusted third party. The third is autonomy. And the third level has a consequence: the only encryption that takes the provider out of the loop is also the one that stops its AI, or yours, from working on the corpus unless a human opens it. So you do not buy your way out of the trilemma. You design your way out, by moving the balance point, exactly as bitcoin holders have learned to do.

How do I move the balance point without giving everything up?

No tool delivers all three corners. There are six mechanisms, all of them relatives of what fifteen years of holding bitcoin have worked out, and each buys back a little of the corner you give up.

Separate what is needed to act from what is secret. An encrypted calendar still sends a reminder: its server knows the time of the event, not its content. Proton describes its calendar that way: times and alarms are signed but readable, while the title, location and attendees are encrypted. For a corpus, the server knows there is a deadline to flag, not which one. It knows the “when”, not the “what”.

Hot, then cold. A piece of data lives readable for as long as something has to compute on it, then it is sealed. The server can seal on its own, with the company's public key; reopening takes a human, with the private key. This is Bitcoin's hot wallet and cold wallet: a little money online to pay quickly, the rest offline. This week's corpus is hot; the archive is cold.

Do the encrypted work when a human is there anyway. An encrypted queue, emptied by the first device that unlocks: the agent prepares overnight whatever it can on readable data, puts the rest in the queue, and in the morning the first phone to unlock opens the door for it. It is not autonomous, but it is nearly fast.

Signing is not encrypting. What has to be trusted (a decision, a payment, a version of the corpus) is signed and stays readable: the server can read it, but cannot forge it. A Bitcoin transaction has been like that from day one: public, and unforgeable. Many business documents do not need to be secret; they need to be authentic.

One key per drawer. A different key for each drawer of the corpus, instead of a checkbox: permission becomes mathematical, and whoever lacks the key cannot read, whatever the application says. It is one wallet per purpose.

Recover as a group. A company is not a person. Its keys are held by several people, with a copy on paper in a safe: no single person can hand everything over under pressure, and no departure, no accident, locks the corpus. This is multisig, standard in Bitcoin since 2011: two keys out of three to open, and the third in the safe.

These six mechanisms stay abstract until you lay them over what a small company actually owns. Hence the table.

Concretely, in my company, which capital goes where?

In practice, a company's intangible capital fits in three drawers. Each drawer gives up a different corner, and that is what makes the trilemma liveable: you do not choose once for everything, you choose three times.

• The first drawer: strategy, decisions, positioning, weak signals. What it is: the heart of the corpus, what the AI must read to answer your questions rather than generic ones. The corner you give up: none, if the model comes to the data. Where it runs: in-house, readable, with a local AI, that is, a model running on the company's own hardware. Fast and autonomous; security rests on your walls and on your encrypted backups.
• The second drawer: customers, contracts, R&D. What it is: what has value to a competitor and carries obligations to others. The corner you give up: autonomy, knowingly. Where it runs: encrypted at the second level with a provider under contract, one that commits in writing to what it reads and what it keeps, or locally. Secure and fast; you accept a third party, and you choose it.
• The third drawer: secrets. What it is: bank access, passwords, patents being filed, an acquisition in the works. The corner you give up: speed. Where it runs: nowhere. Zero-access, never read by an agent; a human opens, and closes. Secure and autonomous; you accept slowness, because here slowness is protection.

One example, which is not a recommendation: at Network Effect, the corpus is a second brain made of plain-text files, notes and a versioned repository, that is, a folder in which every change is dated and signed. The AI reads all of it. Secrets never go in: they live elsewhere, under lock, in a password manager and in files the repository ignores. What matters is not the tool, it is the architecture: what stays readable, what is encrypted, who holds the keys.

That trust architecture is what CORPUS designs with each company: which capital goes in which drawer, where the model runs, who holds the keys and how they are recovered. All three lines of the table rest on the same question, who holds the keys. And Bitcoin answered it, for the other intangible capital, the one that is capital.

Why think like a bitcoin holder?

In Bitcoin, there is nothing but keys: whoever holds the private key holds the bitcoin, and nobody can give it back if they lose it or take it away if they keep it. It is the same public-key cryptography as the levels of encryption above, standardised decades ago for email (OpenPGP) and, recently, for passwordless sign-in (WebAuthn, the passkeys). Fifteen years of holding have taught the world how to keep a capital whose key is its only existence.

“Not your keys, not your coins,” holders say. For the corpus, it becomes: not your keys, not your brain. If your intangible capital can only be read by a provider, with their keys, on their terms, it is not yours. It is on loan to you.

And the discipline of holding fits in one sentence, which is Network Effect's position: better to rebuild your data than to have it stolen. Lost capital can be rebuilt, with time and money: the people are still there, and so are the files. Stolen capital is never recovered, and it benefits a competitor who never had to build it. So you accept the risk of loss to rule out the risk of theft: you encrypt what must be encrypted, you spread the keys, and you test the recovery before you need it. That is what we teach for bitcoin in the F102 course, and it is the same exercise for the corpus.

That discipline also obliges us to say what encryption does not cover.

What does encryption not protect?

Four limits, stated plainly: a leader who knows them chooses better.

A web application's code comes from the server every time you open it. In a browser, the server sends you, each time, the program that does the encrypting; a compromised or coerced server could send one that hands over your password. Proton acknowledges this in its own threat model. An installed application, whose code does not change with each visit, protects better than a web page.

Backups keep what you think you deleted. A deleted document survives in yesterday's copy, last week's, last month's, at your office and at the provider's. Backups follow the same rules as the corpus.

You protect the stock, not the flow. What arrives from outside, an email, an invoice, a transcribed call, is read before it is sealed, by the mail server or by the transcription tool. Encryption protects what you keep, not what you receive: you need to know where the capital comes in, and what reads it on the way.

Losing every key means losing the corpus. At the third level there is no “forgot my password” button: that is the price of autonomy. Which is why group recovery, and the ability to rebuild the corpus from its sources, belong in the architecture, not in a plan B.

Knowing these limits is exactly what lets you choose in writing, instead of letting the tool choose.

Where do I start?

The trilemma has no solution; it has a choice. A company that has made that choice in writing, three drawers, who holds the keys, where the model runs, how to recover, keeps its intangible capital and gets a head start on the one that let the tool choose for it. It knows what its AI reads, what it will never read, and it can change provider without losing anything.

CORPUS turns a company's intangible capital into a corpus and designs its trust architecture with it. And for the keys, how to hold them and how to recover them, the F102 course is the same move, learned on bitcoin.

Sources

1. Proton, “What is zero-access encryption?”: proton.me/blog/zero-access-encryption.
2. Proton, “The Proton Calendar security model”: proton.me/blog/protoncalendar-security-model.
3. Proton, “Proton Mail threat model”: proton.me/news/protonmail-threat-model.
4. Google Cloud, “Default encryption at rest”: docs.cloud.google.com/security/encryption/default-encryption.
5. IETF, RFC 9580, “OpenPGP”, July 2024: rfc-editor.org/rfc/rfc9580.
6. W3C, “Web Authentication: An API for accessing Public Key Credentials Level 3”, Recommendation of 25 August 2026: w3.org.
7. Confidential Computing Consortium, the definition of confidential computing, as quoted by Microsoft: learn.microsoft.com.
8. Gavin Andresen, BIP 11, “M-of-N Standard Transactions”, October 2011: github.com/bitcoin/bips.