This is our initial implementation and we know it's limited. Enable encryption on an item FIRST, before you add content. From then on, any data you add to that item will be encrypted by your browser before transfer. The cloud server is not encrypting the data.
Make no mistake, it is end-to-end encryption. The browser encrypts and decrypts the data, not the cloud. The version we're developing will not require the user to have to enable anything beforehand.