I believe the difference is that on device they can do it prior to encrypting the image. On the cloud it is encrypted.