The answer is client-side encryption. https://standardnotes.org/