1. Good point, we are going to publish more details about constraints in the repo within a few days
2. We have implemented row-level security, so you are free to easily implement any privacy role you want: https://docs.sqlitecloud.io/docs/rls. The "forbidden" rows are not synced
About encryption: all communications are over TLS.