Devices, broker, cloud

Okashic runs in three places. Your devices hold the vault and the keys. The broker lets your agents use what’s in the vault without seeing secrets. The cloud syncs and backs up data it can’t read.

Your device	Your device or server	Okashic cloud
Vault — plaintext exists only here, after you unlock.	Broker — uses credentials for the agent. Returns results only.	Cloud — ciphertext only. Sync, backup, recovery.

The trust boundary sits between the broker and the cloud. Nothing to the right of it can read your vault.

Your devices

Every device you set up holds a full copy of your vault, encrypted. Your primary password unlocks it. The vault key is derived from that password on the device and never leaves it.

When you sign in to your account, the app sends the server a verifier derived from the same password. That’s enough for the server to confirm it’s you. It isn’t enough to decrypt anything.

Search runs on the device over the decrypted records, so your searches and their results never reach the cloud.

The broker

The broker is the local service your agents talk to. It ships inside the macOS and Android apps, and as a headless Linux broker for agents that run on a server. Agents reach it over MCP, and each agent identifies itself with its own Okashic API key.

When an agent asks to use a connected service, the broker:

1. checks the agent’s API key,
2. fixes the host and operation to the connection’s manifest,
3. applies the credential and makes the call,
4. filters the response down to the fields the operation declares,
5. writes an entry to the audit log on your device.

The agent gets the filtered result. It never gets the password, token, or session cookie.

Connections

You approve a connection once, in the Okashic app. After that your agent can use the service without asking again. An agent can request a connection, but only you can create one, so a malicious page or email can’t give itself access.

kind	what the broker does
Website sign-in	Signs in to a website and holds the session for the agent.
API token / OAuth	Calls a service with a token or an OAuth sign-in and filters the response.
No credential	Calls a public API that needs no secret.
Custom (REST)	Calls a REST API you define yourself.

You choose which agents may use each connection: open to all of them, or limited to the ones you pick, with per-operation scope on API connections.

What a connection allows

Once a service is connected, nothing stops a misled agent mid-action. On API connections the filter limits what comes back. On a Session connection the agent can act within the whole session. In both cases every action is in your audit log, and you can remove the connection or revoke the agent at any time.

The cloud

The cloud syncs your vault between devices, keeps an encrypted backup, and makes recovery possible. Everything it stores is ciphertext. Sync works record by record, so a change uploads only the records that changed. When the same record changes on two devices at once, both edits are kept: your device reconciles them and surfaces the conflict for you to resolve, rather than dropping one.

If our cloud were breached, the attacker would get encrypted records. They wouldn’t get your passwords, your personal data, or your keys.

Who can see what

	device	agent	cloud
Passwords and tokens	yes	never	encrypted
Personal data	yes	if shared	encrypted
API responses	yes	filtered	no
Audit log	yes	no	no

For the guarantees these parts add up to — and the one limit we’re honest about — see Security & privacy.