Local-first storage

Concept

Local-first storage

Aarmos does not host your keys, chats, or ledger. Everything sits in browser storage on the device you're using. LLM API keys and OAuth tokens live in the AES-GCM vault, unlocked by the device password you set in Settings → Device.

What's on the device

  • Encrypted vault (LLM keys, OAuth tokens, connector secrets)
  • Connector configs, agents, and starter recipes
  • Chat history and prompts
  • Signed audit ledger and receipt chain

Moving devices

Settings → Device → Export encrypted backup. The archive is AES-GCM encrypted with your device password. Import on the new device and enter the password to restore.

Running headless on a server where localStorage isn't the right fit? See BYOS.