Every team I've worked with writes constantly — architecture decisions, runbooks, post-mortems, meeting notes. And almost every team stores that thinking in someone else's SaaS, under someone else's encryption keys, subject to someone else's roadmap.
That's fine, right up until it isn't. Pricing changes. Features move behind higher tiers. An acquisition shifts the privacy posture. For most content this is an annoyance. For the internal documents of a regulated business — or just a team that takes confidentiality seriously — it's a structural risk that everyone quietly agrees not to think about.
The design constraint that shaped everything
The server should never be able to read your documents. emdi uses envelope encryption end-to-end: content is encrypted client-side, keys are wrapped per-recipient, and the server relays ciphertext it cannot open. That single constraint drove most of the interesting architecture — how real-time collaboration works over CRDTs, how comments stay anchored to the text they discuss, and how the audit trail is signed so history can't be quietly rewritten.
Git as the vault
The other decision I feel strongly about: your documents sync to a Git repository you control — GitHub, GitLab, or a self-hosted Gitea. Version history, backups, and portability come for free, using a format and tooling that developers already trust. If emdi disappeared tomorrow, your markdown would still be sitting in your repo, readable by anything.
emdi is self-hosted, private, and free. If your team writes things worth protecting, take a look at emdi.kanzie.com — and tell me what I got wrong. That's what the comments are for.
