# What is sgit, Docs

> sgit is git for encrypted vaults: how it works, what makes it different from git, and the ecosystem around it.

*Source: <https://sgit.ai/docs/what-is-sgit.html> · site v0.6.8 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.*

---

[Docs](index.md) / Introduction

# What is sgit

**sgit is git for encrypted vaults.** Clone, commit, branch, diff and merge folders of files that are encrypted with AES-256-GCM before they leave your machine. The server stores ciphertext under opaque IDs, it never sees your filenames, your contents, or your commit messages.

It's like git and a password vault had a baby.

## How it works

A vault is an ordinary folder plus a `.sg_vault/` directory. When you commit, sgit snapshots the folder into a git-like object graph, commits pointing at trees pointing at content blobs, and encrypts every object client-side. When you push, only changed ciphertext travels. Object IDs are content-addressed (`obj-cas-imm-…`), so unchanged files are never re-uploaded, and the server can deduplicate data it cannot read.

```
your-folder/
├── <your files>            # untouched — a vault is just a folder
└── .sg_vault/
    ├── bare/                # encrypted objects, refs, branch keys
    └── local/               # your private clone-branch key — never pushed
```

The **vault key** (`passphrase:vault-id`) is three things in one string: the address of the vault on the server, the credential to access it, and the root of the local key-derivation hierarchy. Whoever holds it can decrypt the vault; nobody else, including the server, can. See the [security model](../security/index.md) for the full derivation chain.

## What makes it different from git

- **Everything is encrypted client-side**: content, filenames, messages, branch names.
- **No staging area**: commit snapshots the whole folder, like `git commit -a` for everything.
- **A two-branch model**: a private clone branch per machine or agent plus shared named branches, which is what makes safe multi-agent collaboration possible. [Details →](two-branch-model.md)

## One vault, three doors

- **sgit**: this CLI. Open source, Apache-2.0, `pip install sgit-ai`.
- **SG/Vault**: the web app: browse, edit and review the same vaults in a browser, via an independent implementation of the same wire format. [How it works →](https://sgraph.ai)
- **SG/Send**: the zero-knowledge transfer API both clients speak to. [How it works →](https://sgraph.ai)

**Maturity:** sgit is in beta and has been powering production workflows for a while. The vault format is versioned and `sgit migrate` handles upgrades. Read [when NOT to use sgit](limitations.md) for the honest edges.

[Installation →](installation.md)


---

*[Site index for agents](../llms.txt) · [HTML version](https://sgit.ai/docs/what-is-sgit.html)*