Every device current. No server that can read a word.

What zero-knowledge sync means

When two of your devices sync, changes travel through a relay server. In SideClick those changes are encrypted before they leave the device, with keys that exist only on hardware the practice has enrolled. The relay stores and forwards sealed envelopes; it has no key, no plaintext copy, and no way to manufacture either.

This is a structural property, not a policy promise. The operator cannot read patient data, and neither can anyone who breaches, buys or subpoenas the relay — there is nothing readable to hand over. When a vendor says "we take privacy seriously", ask them the sharper question: can your servers read my records? SideClick's answer is no, mechanically.

Simultaneous work that converges

Sync is built on CRDTs, data structures designed to merge concurrent changes deterministically. Two clinicians updating the same record on different machines converge to the same result on both, without a server adjudicating. The rare genuine conflict — two people editing the same field in opposite directions — is surfaced to a human to resolve rather than silently overwritten.

Devices you trust, explicitly

Every syncing device is enrolled deliberately, and every enrolment is revocable. A seat includes three devices: typically the clinic desktop, a laptop, and a phone running the mobile app.

The threat model for a lost laptop is worth spelling out. Its local database is encrypted at rest, so possession does not equal disclosure; and revoking the device ends its sync access immediately. Losing hardware becomes an inconvenience with a checklist, not a notifiable breach by default.

How it works in practice

You see a patient in the clinic and sign the note at the desktop. Driving home, the front desk reschedules tomorrow's first appointment. That evening your laptop opens with both changes already merged and waiting. Nobody exported anything, nobody emailed a database file, and the relay in the middle carried only ciphertext it could not read.

Offline first, backup included

Every device works fully offline and queues its changes; reconnection merges the queue. Practice editions also keep a relay-side backup of the same ciphertext — an off-site copy that adds recoverability without adding a readable copy anywhere. Local .cfbak backups remain available in every edition.

Editions

Sync arrives with the Practice edition; Solo is deliberately a one-machine product with no relay in the loop at all. The pricing page shows the ladder, including exactly what pauses if a licence lapses (existing data never locks).