> For AI agents: the documentation index is at https://docs.umbraprivacy.com/llms.txt, and every page is available as Markdown at its URL with .md appended.

# Where data lives (/docs/architecture/data)

Umbra's data is split between the chain, off-chain archives and your device. Only the chain is replicated by Solana; everything else depends on whoever operates it.

The chart below shows where a value transaction's data goes once it lands. The chain keeps the state a proof checks against. The data endorser's archive keeps the encrypted notes, which never touch the chain. The indexer joins the two and serves them to devices. The relays in front of the guardian nodes and the fee enclave keep the escrow copies those enclaves return.

```mermaid
flowchart LR
T["Transaction"] --> A["Pool accounts"]
T --> L["Program logs"]
E["Endorser archive"] --> I["Indexer"]
L --> I
I --> D["Your device"]
R["Enclave relays"] --> W["Escrow archives"]
```

*Where a value transaction's data is stored, and how it reaches your device.*

## What this means

**The chain is enough to check, not enough to receive.** A tree account keeps only its frontier and its 512 most recent roots, and the program writes each new leaf to its logs. Everything a proof needs can therefore be rebuilt from Solana's history. Encrypted notes are different: the chain holds only the memo digest that binds them, and the notes themselves live in the data endorser's archive. If the archive lost a note's encrypted copy, its recipient could not find or spend it. That is why the data endorser must sign every value transaction: its signature says it has archived the notes the transaction commits to.

**Your device holds a cache.** In Umbra's clients your keys derive from your account signature, and your notes and history can be found again by rescanning the published notes. Losing your device loses nothing a rescan cannot rebuild, as long as the archive is available. See [recovery](https://docs.umbraprivacy.com/docs/account/recovery).

**The escrows are written once.** The relays in front of the guardian nodes and the fee enclave store each escrow copy in an archive that cannot be overwritten. Each escrow is sealed under a key derived from the sealing enclave's own secrets, so only that enclave service can open it. The fee openings are what lets the treasury collect fees.

## Related

- [Receiving and syncing](https://docs.umbraprivacy.com/docs/operations/receive-and-sync): How notes reach recipients.
- [Liveness](https://docs.umbraprivacy.com/docs/security/liveness): What happens when the archive is down.
- [Every tree](https://docs.umbraprivacy.com/docs/state/trees): The on-chain state in detail.
- [Off-chain services](https://docs.umbraprivacy.com/docs/architecture/services): Who runs each store.


Last updated 12 October 2026