Yes, that's what I meant. Implement web crypto and allow the user to use his own encryption key. So nobody but you and the recipient can access it (unless they can crack it, of course).