Source: https://lodos.md/en/security Language: en # Security: zero-knowledge by design, not policy lodos is zero-knowledge by design, not by policy. See exactly how your data is encrypted on your device, where the plaintext stops, and why no telemetry exists. ## Security isn’t a setting. It’s the architecture. lodos is zero-knowledge by design, not by policy. Here is exactly how, and where the plaintext stops. ## The guarantee, in plain words. Your master password never leaves your Mac. Your data is encrypted before it’s ever written to disk. We, and any cloud you choose, only ever see opaque ciphertext. Not even we can read your vault. ## What we can and can’t see. The most honest thing a company can show you. We can see We can never see - Your email address - Your billing status - That an encrypted backup exists - Its size and timestamp - Your vault and secrets - Your wiki, tasks and notes - Your AI conversations - Your master password or keys ## Where plaintext stops. Your password derives a key that never leaves the device. Everything past this line is ciphertext. - Master password - Argon2id key derivation - Encryption key (on-device) - libsodium secretbox - Encrypted blob - Optional sync, opaque plaintext never crosses this line ## Your AI can’t see your sk_live key. When a task needs a credential, lodos decrypts it locally and passes it to a subprocess as an environment variable, outside the model’s view, gone the moment the job is done. The AI only ever handles a reference like {{secrets.stripe.sk_live}}. No tool in lodos returns a plaintext secret, and a build-time invariant check fails the release if one is ever added. ### Referenced The model sees a placeholder, never a value. ### Injected The real secret enters a subprocess at runtime, never the transcript. ### Audited Every access appends to a tamper-evident HMAC chain. ## The moat is checked at compile time. A build-time invariant scan runs on every release. If any one of these is ever violated, the build fails, so the guarantee can’t quietly decay into a policy. - No bash, no exec, no tool that returns a secret value - No raw model-API provider, only embedded Claude Code - No eval, Function, vm or child_process on any render path - Unknown tools fail closed, never silently allowed - The agent runs with bash explicitly disallowed - No single grant can complete the lethal trifecta - Declarative-only workflows, no code path to execute There is no tool that returns a plaintext secret, and the build fails the moment anyone adds one. Field names Reference Subprocess what the AI can see plaintext never reaches the model ## The primitives, named. No custom crypto. Audited, standard building blocks. ### Argon2id Memory-hard key derivation, 64 MB / 3 iterations, GPU- and ASIC-resistant. ### XChaCha20-Poly1305 Authenticated encryption via libsodium secretbox, per-section keys. ### HMAC-SHA256 chain Every vault and wiki action signed and linked, tampering breaks the chain. ### 160-bit recovery key High-entropy, generated on-device, never stored by us. ### secretstream sync 64 KB authenticated chunks, bound to your account so a blob can’t be replayed. ### Opaque field paths Audit logs record that a secret was used, never which one. ## lodos vs. the cloud company OS. lodos Typical cloud tool Encrypted at rest Zero-knowledge (vendor can’t read it) Runs fully offline Tamper-evident audit trail AI can read your secrets No telemetry ## And what this does not protect against. Zero-knowledge protects your data from us and from the network. It cannot protect a device that’s already compromised, or a master password that’s easy to guess. Strong device security and a strong password are still yours to keep. We’d rather say so than overclaim. ## Known limits, stated plainly. - Subprocess network egress is allowlist-guarded, not a hardware sandbox. - macOS notarization is pending. Early builds install with a Gatekeeper prompt. - We never proxy a third-party model; you bring your own Claude. ## Read it, then trust it. Download lodos and keep your keys where they belong.