Files are encrpyted/decrypted locally prior to upload/download from the cloud server. There's a solid breakdown of what it is and isn't good at doing here: https://docs.cryptomator.org/security/security-target/