Concept

Local-first storage

The PWA stores user-entered provider keys, chat history and local evidence in browser storage on the device you're using. Storage is separate from transmission: credentials and request data are sent to configured providers or tool endpoints when used. Tool traffic may also pass through a customer-operated forwarder you configure.

Supported saved credentials — LLM provider keys, OAuth tokens, tool (MCP) credentials, custom-API credentials, live-view credentials and backup-destination credentials — are held in the on-device vault. Setting a device password encrypts the vault under a key derived from that password. Without a password, vault storage does not provide meaningful protection against someone who can read browser storage. Older plaintext records are moved into the vault the next time it is unlocked. Other app data, such as chats and settings, is not encrypted by the device password.

What's on the device

• Vault-held provider keys, tokens and tool, API, live-view and backup credentials; password protection is optional
• Connection settings (non-secret)
• Connector configs, agents, and starter recipes
• Chat history and prompts
• Signed audit ledger and receipt chain

Moving devices

Settings → Device → Export encrypted backup. The archive is encrypted and requires your device password. It contains supported browser-storage records, not a complete device backup. Import on the new device and enter the password used when the backup was created.

For customer-controlled A2A token storage, see BYOS. That interface is not a general replacement for chat-history or receipt storage.