And on top of it I'll add that Syncthing added a feature called "untrusted device encryption" https://docs.syncthing.net/specs/untrusted.html https://docs.sync

And on top of it I'll add that Syncthing added a feature called "untrusted device encryption" https://docs.syncthing.net/specs/untrusted.html https://docs.syncthing.net/specs/untrusted.html So you can set a node in the cloud and set an encryption key between two endpoints, and whichever nodes that have the directory synced but doesn't have the encryption key will never have access to the decrypted data.