✓Direct Answer

Your Oyma notes and audio files are protected at rest by macOS FileVault full-disk encryption. FileVault uses hardware-accelerated XTS-AES-128 encryption tied to the Apple Silicon Secure Enclave to protect your files against physical theft.

Hardware-Rooted Encryption at Rest

When evaluating data security at rest, software-level encryption (where an application creates an encrypted container that requires an in-app password) often introduces severe performance overhead, risks corrupting files during crashes, and breaks third-party search and backup workflows.

Instead of reinventing custom encryption containers, Oyma leverages Apple’s hardware-accelerated operating system security: macOS FileVault.

How FileVault Protects Your Vault

When FileVault is enabled on your Mac (which Apple recommends during initial macOS setup):

  1. Hardware-Accelerated Encryption: The entire APFS volume is encrypted using XTS-AES-128 encryption with a 256-bit key.
  2. Secure Enclave Integration: On Apple Silicon Macs (M1 through M4), cryptographic keys are bound to the hardware Secure Enclave.
  3. Protection in Power-Off and Locked States: If your laptop is stolen, lost in transit, or removed from your office, the raw flash storage cannot be read without your macOS account credentials or recovery key.
[Apple Silicon Secure Enclave]
             | (Hardware cryptographic key)
             v
 [APFS Encrypted Volume: FileVault XTS-AES]
             |
   +---------+---------+
   |                   |
[System Files]   [Oyma Vault: notes & audio]

Checking Your FileVault Status

You can verify that your Mac drive is encrypted at rest in under 30 seconds:

  • Open System Settings > Privacy & Security > FileVault.
  • Confirm that FileVault is toggled On.

Because FileVault operates at the kernel and NVMe hardware level, your Oyma notes enjoy military-grade encryption at rest with zero performance overhead during daily editing.

Hardware-Level Protection with macOS FileVault

Securing note files against physical device loss or theft:

  • XTS-AES-128 Full-Disk Encryption: Apple’s native encryption protects the entire APFS storage volume automatically.
  • Secure Enclave Integration: Encryption keys are tied to the Apple Silicon hardware Secure Enclave.
  • Protection in Powered-Off States: If your laptop is stolen, raw flash storage cannot be accessed without user credentials.
  • Zero Performance Penalty: Hardware-accelerated AES instructions ensure editing notes incurs zero perceptible latency.

Military-Grade Hardware Encryption on APFS

With macOS FileVault enabled, your entire vault benefits from XTS-AES-128 full-disk encryption tied to Apple Silicon’s Secure Enclave, protecting confidential files against unauthorized physical extraction.

Even if an attacker physically removes the flash memory chips from your Mac, the data cannot be decrypted without your user password and the hardware keys stored inside the Secure Enclave.

Encryption at Rest Invariants

  • Encryption Standard: Full-disk XTS-AES-128 encryption with 256-bit cryptographic keys via FileVault.
  • Hardware Integration: Cryptographic keys bound to the Apple Silicon Secure Enclave.
  • Theft Protection: Raw NVMe flash storage cannot be read when powered off without user credentials.
  • Performance: Hardware AES accelerators eliminate perceptible reading or writing latency.

Related Questions & Architecture Guides