The pandemic has caused many admins and users to migrate from public to on-premise, private clouds. And with Nextcloud being one of the most capable and popular solutions, the developers have made it such that it includes support for all the features you need. 

One new feature is the production-ready support of end-to-end encryption. This new addition should be considered a must-have for extremely sensitive information (such as social security numbers, medical information, etc.). What the developers have done is create an encryption solution that works with the server never having access to the unencrypted files or keys. Users pick a folder and encrypt that folder locally (via the newly released version of the desktop client). Once a folder is encrypted via the desktop client, any file contained within is no longer available on the server, so it cannot be shared via the standard, built-in tools. 

Although the encrypted files are no longer available to the server, they are available to the sync'd clients. So when users have multiple clients connected to their Nextcloud account, they'll be able to access those encrypted folders from the desktop (or mobile) client (but not from the server).

According to the Nextcloud PR:

"Organizations that demand the utmost security need a true enterprise solution that doesn’t require users to manually exchange encryption keys and long, complex passwords or share large, encrypted volumes. Nextcloud is first to market with an integrated, secure technology to keep a subset of highly sensitive files cryptographically secure even in the worst case of an undetected, full server breach."

Find out more from the official release statement from Nextcloud.