Whitepaper from Arxiv describing their scheme for others who like seeing underlying details of security tech:

https://arxiv.org/pdf/1602.07168v3.pdf

@ ZeroDB developers

I know the goal is to have the cloud provider untrusted in this model for storage/processing. However, have you considered them actively malicious in how they handle the protocol steps with the on-site client? As in, at each step (eg a query), they might try to attack the protocol or especially the implementation (a la OpenSSL infamy). Just make sure you have defenses for that sort of thing.