Client-side encrypted workspace