What is Plain Text Storage at Rest?

Storing files “unencrypted at rest” within an application refers to the architectural design where an application writes human-readable UTF-8 plain-text files directly to the host operating system’s filesystem, without wrapping individual files inside proprietary encrypted containers, encrypted SQLite blobs, or custom password-protected packages.

In software engineering, there is a recurring architectural debate: Should a note-taking application implement its own custom file encryption layer, or should it store transparent plain text and delegate physical disk protection to the underlying operating system?

The severe failure modes of application-level encryption

Many note-taking tools attempt to build custom cryptographic file formats. While this sounds secure in marketing brochures, in practice it introduces catastrophic failure modes:

1. Cryptographic corruption and data loss: If an application crashes during a database write or corrupts its encrypted header, the entire database becomes permanently unrecoverable. Decades of personal notes vanish in an instant.
2. Broken operating system integration: When files are locked in an encrypted database, native macOS features cease to function:
   • macOS Spotlight cannot index your notes.
   • Terminal tools like grep, ripgrep, and find cannot search your files.
   • Automated backup tools like Time Machine or rsync cannot perform granular file-level incremental backups.
   • Version control systems like Git cannot display line-by-line diffs.
3. Application dependency lock-in: You can only read your notes as long as that specific application exists and runs on your operating system.

The layered security model: Transparent files on an encrypted volume

Modern computer security relies on defense-in-depth through proper architectural layering:

[Application Layer (Oyma)]
      ↓ (Writes clean, durable, open UTF-8 Markdown)
[macOS Filesystem Layer (APFS)]
      ↓ (POSIX Permissions + Sandboxing Access Controls)
[Hardware Encryption Layer (Apple FileVault + Secure Enclave)]
      ↓ (Hardware XTS-AES-128 Encryption on Physical NVMe NAND)
[Physical Flash Silicon]

Under this architecture:

• When your Mac is awake and unlocked by your password or Touch ID, you enjoy the full speed and interoperability of transparent plain text.
• The moment your Mac is locked, powered off, or stolen, Apple Silicon’s hardware Secure Enclave seals the volume keys. The physical storage drive is an unreadable scramble of encrypted bytes.

The philosophy of Oyma

Oyma adheres firmly to this layered model:

• We write standard, beautiful Markdown documents directly to your local drive.
• We rely on Apple’s proven, multi-billion-dollar investment in FileVault and Secure Enclave hardware encryption for physical security.
• You maintain the permanent longevity of open plain text with zero risk of database corruption.