Accounts are provisioned by an administrator — contact your admin if you need access. First use on this browser generates a non-extractable RSA-OAEP keypair stored in your IndexedDB. The private key cannot be read, only used. The master key never touches disk.