where is the data decrypted and when?

One of the problems I have with eyaml is that the data is decrypted on the master and then stored unencrypted in the catalog which could be retrieved from the puppetdb.  Does your gem decrypt on the agent side or master side?
