Transport encryption, storage encryption, password managers, backups, messaging, biometrics and cloud storage look like separate subjects. They are one question repeated: who is in a position to read this, and what would it take. A single frame for the whole field, and where each common arrangement sits inside it.
The question
Security is usually taught as a list of mechanisms — certificates, hashing, access control, second factors — which makes it feel like a large subject with many parts.
Underneath, almost every practical decision reduces to one question: who holds the key? Not only in the cryptographic sense. The key is whatever confers the ability to read: a passphrase, an administrative console, a support tool, a backup nobody thought about.
Every product answers this in its architecture, whether or not the answer appears anywhere in its marketing. And the answer is usually discoverable in about a minute, which is the practical value of the frame.
Four positions
Not a ranking. Each is correct for different material, and the error is not choosing badly — it is being in one position while believing you are in another.
Nobody but you. Keys derived on your device and never transmitted. The provider holds ciphertext. No server-side search, no previews generated remotely, no recovery when you lose the key. Strong against the provider being compromised or compelled; fragile against you.
You and the provider. The provider can read it, usually for reasons that are functional rather than sinister. Most software people use lives here, and most of it is honest about needing to.
The provider, not you. Material held about you that you cannot read or retrieve: derived profiles, scores, inferences, models. The asymmetry is the defining feature — it is yours in origin and not yours in access, and you often cannot see it to correct it.
Nobody, by construction. Never collected. The only position with no failure mode, and available only before collection happens, which is why it is the one decision that cannot be revisited later.
A single product commonly occupies several at once. A messaging application can be in the first position for message content, the second for metadata, and the third for the behavioural model built from usage. Treating it as one position is how people end up mistaken.
How to locate any product in a minute
What happens on password reset? Data restored means the provider holds a route to your key. Data lost means it does not. This one question settles most cases and cannot be answered evasively for long.
Is there server-side search of content? Searching your own documents from a new device means something read them to build an index.
Can support see your data? If an agent can look at your files to help, so can anybody who becomes that agent.
What does recovery fall back to? A code to your email means your email is the real key. A phrase you wrote down means you are.
Where the common arrangements sit
Transport encryption is always the second position. It protects data in motion and the endpoint decrypts it on arrival — which is the point, since the server has to act on it.
Encryption at rest is the second position. The provider holds the key that opens it, because the service has to open it to work.
End-to-end messaging is the first position for content and the second for metadata. This is the distinction most often missed, and metadata is frequently the more revealing half: who, when, how often, for how long.
Password managers are the first position, with the master password as the key. Losing it loses the vault, and that fact is the evidence the property is real.
Backups are whichever position you chose, and most people have not chosen. Default settings usually mean the second, for the richest collection of material you own.
Biometrics depend entirely on whether matching happens on the device or on a server. Same gesture, different positions, and the interface rarely says which.
Cloud storage is nearly always the second position regardless of how the page is written.
Why the second position is not a scandal
It buys real things: search across devices, previews, sharing by link, spam filtering, abuse detection, and recovery when somebody forgets a password — which is most people, eventually.
A service in the second position that says so is behaving correctly. The trade is reasonable and most material does not warrant anything stricter.
The failure is never the position. It is being in the second while believing you are in the first, which is a description of marketing rather than of engineering, and which leaves people making decisions about sensitive material on a false premise.
The failure that crosses all four
Recovery, where positions quietly collapse.
A service in the first position that restores your data after a complete password reset was never in the first position. It cannot have been. Restoring requires a route to the key, and holding a route to the key is the definition of the second.
And an attacker who cannot defeat the front door does not keep trying it. They go to recovery, which frequently sits in a weaker position than the thing it recovers — an email address, a phone number that can be reassigned, a support agent applying judgement under pressure.
So the position of a system is not the position of its strongest component. It is the position of its recovery path.
What changes when you hold the key
The responsibility moves to you, and it does not move back.
The key has to survive whatever happens to the device. The convenience features go. And the software performing the encryption is, in the ordinary case, delivered by the party you are protecting yourself from — which makes the first position a claim about a specific delivered build rather than a permanent property of the service.
That last point is not a reason to avoid it. It is a reason to state it accurately, because a first position that depends on a build is still a great deal stronger than a second position that depends on a promise.
Where I think the line sits
For legally privileged material, health records, unpublished work, and material belonging to somebody who did not consent to any of this, the first position is worth its costs. The inconvenience is real and the exposure is worse.
For ordinary correspondence and working documents, the second position is the right answer, and I use it daily without embarrassment. Search and recovery are genuinely valuable and most of what I write is not sensitive.
The thing I would not do is hold the second sort of material under the impression that it is the first sort. That is the only mistake in this piece that costs anything.
The question again
Who holds the key. Ask what happens on password reset, whether the service searches your content, whether support can see it, and what recovery falls back to.
Four answers, one minute, and you know where you are standing.