Enpass optionally lets you synchronize your data across devices though a wide range of supported clouds.

Your cloud always contains a copy of same encrypted data as on your device. A copy of your encrypted data is downloaded on your device where is gets decrypted (locally) for real sync operation to merge changes. Afterwards, it gets encrypted again and uploaded back to the cloud.

In a nutshell, your cloud works only as a storage medium and no cryptographic operation (encryption or decryption) is performed there. All such operations are performed locally on your device and your data never leaves your device in unencrypted format.

So somehow, if an attacker gains access to your Enpass data file, he finds it protected with your Master Password and thus making is unuseful for him.