Where quarantined files actually go

Quarantined files never leave the customer's machine.

1. 1Quarantine (from a detection page or as an automatic engine action) moves the file into an encrypted store on the endpoint itself.
2. 2Windows path: %ProgramData%\Cybermatic\quarantine — files are AES-256-GCM encrypted with a machine-bound key; a .meta.json records the original path and time.
3. 3Only metadata (path, hash, verdict) reaches the Cybermatic cloud — never file contents.
4. 4Restoring a file is a support-assisted operation in v1 — open a ticket from the Support page with the device and detection.