Private vault, client-side keys.

The server syncs encrypted records only. Master password, vault key, item passwords, notes, and secrets stay on this device unless they are encrypted first.