Security
Security isn’t a setting. It’s the architecture.
lodos is zero-knowledge by design, not by policy. Here is exactly how, and where the plaintext stops.
The guarantee, in plain words.
Your master password never leaves your Mac. Your data is encrypted before it’s ever written to disk. We, and any cloud you choose, only ever see opaque ciphertext. Not even we can read your vault.
What we can and can’t see.
The most honest thing a company can show you.
We can see
- Your email address
- Your billing status
- That an encrypted backup exists
- Its size and timestamp
We can never see
- Your vault and secrets
- Your wiki, tasks and notes
- Your AI conversations
- Your master password or keys
Where plaintext stops.
Your password derives a key that never leaves the device. Everything past this line is ciphertext.
The AI moat
Your AI can’t see your sk_live key.
When a task needs a credential, lodos decrypts it locally and passes it to a subprocess as an environment variable, outside the model’s view, gone the moment the job is done. The AI only ever handles a reference like {{secrets.stripe.sk_live}}. No tool in lodos returns a plaintext secret, and a build-time invariant check fails the release if one is ever added.
Referenced
The model sees a placeholder, never a value.
Injected
The real secret enters a subprocess at runtime, never the transcript.
Audited
Every access appends to a tamper-evident HMAC chain.
Enforced, not promised
The moat is checked at compile time.
A build-time invariant scan runs on every release. If any one of these is ever violated, the build fails, so the guarantee can’t quietly decay into a policy.
- No bash, no exec, no tool that returns a secret value
- No raw model-API provider, only embedded Claude Code
- No eval, Function, vm or child_process on any render path
- Unknown tools fail closed, never silently allowed
- The agent runs with bash explicitly disallowed
- No single grant can complete the lethal trifecta
- Declarative-only workflows, no code path to execute
The primitives, named.
No custom crypto. Audited, standard building blocks.
Argon2id
Memory-hard key derivation, 64 MB / 3 iterations, GPU- and ASIC-resistant.
XChaCha20-Poly1305
Authenticated encryption via libsodium secretbox, per-section keys.
HMAC-SHA256 chain
Every vault and wiki action signed and linked, tampering breaks the chain.
160-bit recovery key
High-entropy, generated on-device, never stored by us.
secretstream sync
64 KB authenticated chunks, bound to your account so a blob can’t be replayed.
Opaque field paths
Audit logs record that a secret was used, never which one.
lodos vs. the cloud company OS.
| lodos | Typical cloud tool | |
|---|---|---|
| Encrypted at rest | ||
| Zero-knowledge (vendor can’t read it) | ||
| Runs fully offline | ||
| Tamper-evident audit trail | ||
| AI can read your secrets | ||
| No telemetry |
And what this does not protect against.
Zero-knowledge protects your data from us and from the network. It cannot protect a device that’s already compromised, or a master password that’s easy to guess. Strong device security and a strong password are still yours to keep. We’d rather say so than overclaim.
Known limits, stated plainly.
- Subprocess network egress is allowlist-guarded, not a hardware sandbox.
- macOS notarization is pending. Early builds install with a Gatekeeper prompt.
- We never proxy a third-party model; you bring your own Claude.
Read it, then trust it.
Download lodos and keep your keys where they belong.
Apple Silicon · macOS 13+ · notarization pending