File and folder names containing sensitive information get encrypted with non-deterministic encryption (i.e., with random IV) and get decrypted only for display

File and folder names containing sensitive information get encrypted with non-deterministic encryption (i.e., with random IV) and get decrypted only for displaying purposes. Software can handle GUIDs as file and folder names whereas the real names are kept encrypted. For indexing, unpredictable data can be hashed (with a salt unique to the field). Both predictable and unpredictable data need get deterministically encrypted - usually with IV being an SHA-2 or SHA-3 hash of the data. This works for exact searches only, of course.