# Who can read what your company knows? The security trilemma in the age of AI > Fully secure, fully autonomous, fully fast: you cannot have all three. Who holds the key to your intangible capital, and how to choose, drawer by drawer. Article · By Élie Sader, Network Effect · Published on November 3, 2026 To serve your company, an artificial intelligence (AI) has to read what it knows: its intangible capital. And what an AI can read, someone else can read. You would like that capital safe, an AI that works without waiting, and nobody but you holding the key. You cannot have all three. It is a trilemma; it has no solution, only a choice, drawer by drawer, and people who hold their own bitcoin know it by heart. > Fully secure, fully autonomous, fully fast: you cannot have all three. ## What do we mean by “corpus”? What a company owns that is singular is neither its machines nor its software, which a competitor can buy tomorrow: it is what it knows. Its knowledge of its customers, not the file; of its trade, of what a job well done looks like; of its processes, as they really happen; its interactions with the real world, suppliers, the field, the weak signals its leader picks up before anyone else; its strategy, what it has given up, and where it is going. And, between those layers, the gaps: everything written down nowhere, the reasons behind decisions, what the founder knows without ever having said it. That is its intangible capital, a capital of knowledge that appears on no balance sheet. We described it in full in [Intangible capital: what makes your company singular](https://networkeffect.fr/en/intangible-capital/). That capital has always worked without being written. AI is writing it, one use at a time: every instruction that spells out how you work, every document handed over to be read, every answer corrected because it did not sound like you lays a piece of it down in text. Written, structured and readable by an AI, that capital becomes a corpus. So a corpus is not a document base: it is the company's intangible capital, in a form a machine can read. One capital, two faces, as we put it: knowledge on one side, Bitcoin on the other, capital itself gone digital. The intangible capital article asks what has to be written, and where. This one asks the question that comes right after: once written, **who can read it?** ## If the AI works on my files overnight, where are my files? Sooner or later, the business owner who has put AI to work makes an uncomfortable discovery. The agent that drafts their answers overnight reads their files overnight, without them, on someone else's machine; an AI agent is a program that acts on its own, it reads, prepares, executes. For it to act without you, it has to read without you. And a corpus readable by a program is readable by whoever hosts the program, whoever attacks it, whoever subpoenas it. They then want three things, each pulling its own way: their capital safe, an AI that works right away, even when nobody is around, and the key in their hands alone. It is the trilemma bitcoin holders ran into before anyone else, for the other face of the same capital. ## Secure, fast, autonomous: what do these three words mean? **Secure**: the corpus is encrypted with keys that only its owner holds, and that no single person can hand over under pressure. A compromised server, a disloyal employee, a laptop left on a train or a court order yield nothing but noise. To encrypt is to make a text unreadable without a key, a secret its holder keeps on a device or on paper. **Fast**: the AI answers and acts right away. Tomorrow's meeting gets prepared overnight, the customer gets served during the appointment, the market gets watched during the holidays, with nobody around to unlock anything. **Autonomous**: no trusted third party. Nobody but the owner of the content holds the keys or reads the corpus; no provider can read it, cut it off, or hand it to whoever asks. Pick two, and the third falls. It is the triangle drawn for holding bitcoin, and it holds just as well for what a company knows.  - **Secure and fast** means a trusted third party keeps the keys and unlocks for you. It is today's model: your documents with a large provider, encrypted by them, read by their AI when you ask, and by them when they decide. You are not autonomous. In Bitcoin, this is the custodian: the platform that holds your bitcoin and shows you a balance. - **Secure and autonomous** means the keys are spread out and nothing opens without a human. The agent waits to be let in; it does not work at night. In Bitcoin, this is multisig across three distant places: one person holds the keys, but has to travel to each of the three places to spend. It is very slow, and it is meant to be. - **Fast and autonomous** means everything is readable locally, behind a single key or a plain password, and security has dropped: the stolen laptop takes everything, and so does the employee who leaves. In Bitcoin, this is a single key on a single device. The corner most companies sacrifice today, they sacrifice without knowing it: autonomy. Their provider told them their data was encrypted, and it is true. You have to look at what “encrypted” means when someone else holds the key. ## My provider says my data is encrypted: against what? The word “encrypted” covers three levels, and they do not protect against the same things. The question to ask is not “is it encrypted?” but **who holds the key**.  At the **first level**, data is encrypted “at rest” by the hosting provider: on its disks, with its keys. That protects against **a stolen disk** in a data centre, and Google says so of its own default encryption: it owns and manages the keys. Against **access to the database**, **an employee of the provider** or **a request from the authorities**, this level protects nothing: the database opens for anyone entitled to query it. At the **second level**, data is encrypted by the application server, with the keys stored separately. That protects against **a copy of the database** or **a leaked backup**: they contain only noise. But the server itself can decrypt: that is its job. So it protects neither against **an attacker inside the application**, who reads what the application reads, nor against **the provider itself**. This level is not “plaintext”: it is encrypted, yet readable by the server, and that is what lets the provider's AI work fast on your documents. At the **third level**, called “zero-access”, **only the owner of the content holds the key**: you, not the host, not the application. The private key never leaves your device; the server stores and forwards, but cannot read anything, and therefore cannot compute anything. That protects against everything above, **the provider and the subpoena included**. Proton, which built its mail service on this principle, puts it simply: because the server does not have the private key, the provider cannot read the data it stores. The first two levels are the trusted third party. The third is autonomy. And the third has a consequence: the only encryption that takes the provider out of the loop is also the one that stops its AI, or yours, from working on the corpus unless a human opens it. So you do not buy your way out of the trilemma. You design your way out, by moving the balance point, as bitcoin holders have learned to do. ## How do I move the balance point without giving everything up? No tool delivers all three corners. There are seven mechanisms, nearly all of them relatives of what fifteen years of holding bitcoin have worked out, and each buys back a little of the corner you give up. **Separate what is needed to act from what is secret.** An encrypted calendar still sends a reminder: its server knows the time of the event, not its content. Proton describes its calendar that way: times and alarms are signed but readable, while the title, location and attendees are encrypted. For a corpus, the server knows there is a deadline to flag, not which one. It knows the “when”, not the “what”. **Hot, then cold.** A piece of data lives readable for as long as something has to compute on it, then it is sealed. The server can seal on its own, with the owner's public key; reopening takes a human, with the private key. This is Bitcoin's hot wallet and cold wallet: a little money online to pay quickly, the rest offline. This week's corpus is hot; the archive is cold. **In the clear, but only for a moment.** A message passing through a mail system is readable on its way: the email itself is not encrypted, it is in the clear, but for an instant, between two servers. The whole point lies in that brevity. The AI's work can be built on the same principle: a secure enclave receives an encrypted file, opens it, works on it, re-encrypts the result, and erases everything. The file was readable for a few seconds, in one place, and it was the owner of the content who decided when, and for how long. The attack surface, that is, everything an attacker could reach, shrinks to that window. Confidential computing, a processor enclave the host itself cannot read, is its industrial version: the trusted third party changes nature, it is now the chip maker, but the window stays short and you are the one who opens it. **Do the encrypted work when a human is there anyway.** An encrypted queue, emptied by the first device that unlocks: the agent prepares overnight whatever it can on readable data, puts the rest in the queue, and in the morning the first phone to unlock opens the door for it. It is not autonomous, but it is nearly fast. **Signing is not encrypting.** What has to be trusted (a decision, a payment, a version of the corpus) is signed and stays readable: the server can read it, but cannot forge it. A Bitcoin transaction has been like that from day one: public, and unforgeable. Many business documents do not need to be secret; they need to be authentic. **One key per drawer.** A different key for each drawer of the corpus, instead of a checkbox: permission becomes mathematical, and whoever lacks the key cannot read, whatever the application says. It is one wallet per purpose. **Recover as a group.** A company is not a person. Its keys are held by several people, with a copy on paper in a safe: no single person can hand everything over under pressure, and no departure, no accident, locks the corpus. This is multisig, standard in Bitcoin since 2011: two keys out of three to open, and the third in the safe. These mechanisms stay abstract until you lay them over what a small company actually owns. Hence the table. ## Concretely, in my company, which capital goes where? In practice, a company's intangible capital fits in three drawers. Each drawer gives up a different corner, and that is what makes the trilemma liveable: you do not choose once for everything, you choose three times. - **The first drawer: strategy, decisions, positioning, weak signals.** What it is: the heart of the corpus, what the AI must read to answer your questions rather than generic ones. The corner you give up: none, if the model comes to the data. Where it runs: in-house, readable, with a local AI, that is, a model running on the company's own hardware. Fast and autonomous; security rests on your walls and on your encrypted backups. - **The second drawer: customers, contracts, R&D.** What it is: what has value to a competitor and carries obligations to others. The corner you give up: autonomy, knowingly. Where it runs: encrypted at the second level with a provider under contract, one that commits in writing to what it reads and what it keeps, or locally, or through the short window of an enclave. Secure and fast; you accept a third party, and you choose it. - **The third drawer: secrets.** What it is: bank access, passwords, patents being filed, an acquisition in the works. The corner you give up: speed. Where it runs: nowhere. Zero-access, never read by an agent; a human opens, and closes. Secure and autonomous; you accept slowness, because here slowness is protection. One example, which is not a recommendation: at Network Effect, the corpus is a second brain made of plain-text files, notes and a versioned repository, that is, a folder in which every change is dated and signed. The AI reads all of it. Secrets never go in: they live elsewhere, under lock, in a password manager and in files the repository ignores. What matters is not the tool, it is the architecture: what stays readable, what is encrypted, who holds the keys. That trust architecture is what [CORPUS](https://networkeffect.fr/en/services/corpus/) designs with each company: which capital goes in which drawer, where the model runs, who holds the keys and how they are recovered. ## Why think like a bitcoin holder? Because all three drawers rest on the same question, who holds the keys, and Bitcoin answered it fifteen years ago for the other face of intangible capital. In Bitcoin, there is nothing but keys: whoever holds the private key holds the bitcoin, and nobody can give it back if they lose it or take it away if they keep it. It is the same public-key cryptography as the three levels above, standardised decades ago for email (OpenPGP) and, recently, for passwordless sign-in (WebAuthn). “Not your keys, not your coins,” holders say; for the corpus, it becomes: not your keys, not your brain. Intangible capital that only a provider can read, with their keys, on their terms, is not yours. It is on loan to you. And the discipline of holding fits in one sentence, which is Network Effect's position: **better to rebuild your data than to have it stolen.** Lost capital can be rebuilt, with time and money: the people are still there, and so are the files. Stolen capital is never recovered, and it benefits a competitor who never had to build it. So you accept the risk of loss to rule out the risk of theft: you encrypt what must be encrypted, you spread the keys, and you test the recovery before you need it, as we teach for bitcoin in the [F102](https://networkeffect.fr/en/training/) course. ## Who protects what? Put simply, everything above comes down to one idea: **the provider must not be a honeypot.** A honeypot is a place where so much data from so many customers is readable that it becomes a target worth the effort: for an attacker, for a disloyal employee, for an authority that subpoenas. A provider that cannot read anything attracts nobody; it has nothing to give. Encrypting at the third level does not only protect your data, it takes away the provider's reason to be attacked. In doing so, the security model moves to the owner of the content. You are now the one holding the key, and with it the responsibility. Your own computer may be riddled with bad software, your password may be read by spyware, and then you get burgled, at home: nobody can protect you in your place, and Proton says as much of its own users. That is not a flaw in the architecture; it is its principle. What matters is that everything that goes elsewhere, to a host, to an application, into a backup, leaves encrypted, and therefore protected, whatever happens there. Four limits follow from that principle, and they are worth knowing. A web application's code comes from the server every time you open it: a compromised or coerced server could send a program that hands over your key, which an installed application avoids. Backups keep what you think you deleted: they follow the same rules as the corpus. You protect the stock, not the flow: what arrives from outside, an email, an invoice, a transcribed call, is read before it is sealed, so you need to know where the capital comes in. And losing every key means losing the corpus: at the third level there is no “forgot my password” button, that is the price of autonomy, which is why group recovery and the ability to rebuild the corpus from its sources belong in the architecture, not in a plan B. Knowing these limits is exactly what lets you choose in writing, instead of letting the tool choose. ## Where do I start? The trilemma has no solution; it has a choice. A company that has made that choice in writing, three drawers, who holds the keys, where the model runs, how to recover, keeps its intangible capital and gets a head start on the one that let the tool choose for it. It knows what its AI reads, what it will never read, and it can change provider without losing anything. [CORPUS](https://networkeffect.fr/en/services/corpus/) turns a company's intangible capital into a corpus and designs its trust architecture with it. And for the keys, how to hold them and how to recover them, the [F102](https://networkeffect.fr/en/training/) course is the same move, learned on bitcoin. ## Sources 1. Proton, “What is zero-access encryption?”: [proton.me/blog/zero-access-encryption](https://proton.me/blog/zero-access-encryption). 2. Proton, “The Proton Calendar security model”: [proton.me/blog/protoncalendar-security-model](https://proton.me/blog/protoncalendar-security-model). 3. Proton, “Proton Mail threat model”: [proton.me/news/protonmail-threat-model](https://proton.me/news/protonmail-threat-model). 4. Google Cloud, “Default encryption at rest”: [docs.cloud.google.com/security/encryption/default-encryption](https://docs.cloud.google.com/security/encryption/default-encryption). 5. IETF, RFC 9580, “OpenPGP”, July 2024: [rfc-editor.org/rfc/rfc9580](https://www.rfc-editor.org/rfc/rfc9580.html). 6. W3C, “Web Authentication: An API for accessing Public Key Credentials Level 3”, Recommendation of 25 August 2026: [w3.org](https://www.w3.org/news/2026/web-authentication-an-api-for-accessing-public-key-credentials-level-3-is-now-a-w3c-recommendation/). 7. Confidential Computing Consortium, the definition of confidential computing, as quoted by Microsoft: [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/confidential-computing/overview). 8. Gavin Andresen, BIP 11, “M-of-N Standard Transactions”, October 2011: [github.com/bitcoin/bips](https://github.com/bitcoin/bips/blob/master/bip-0011.mediawiki). ## Further reading - [Keep your company's brain](https://networkeffect.fr/en/services/corpus/) - [Knowledge that evaporates: what your company stops learning when everyone solves problems alone with AI](https://networkeffect.fr/en/knowledge-that-evaporates/) - [All resources](https://networkeffect.fr/en/resources/)