KEY DESIGN CHOICE
Keep sensitive relationships out of the server-side data model.
The server does not maintain a central record linking each participant to every event. Participants keep reusable information in a client-encrypted vault and share only the fields an event requires. Separate service roles and encryption policies limit who can decrypt each category of data.