We can’t read your vault. We can’t open it for you either.

You don’t have to: the vault works without one. If you do connect one, give it its own agent vault with only the logins it needs. Its key can’t open your personal vault, and you can revoke it at any time. Treat a connected assistant as able to see everything in the vault you give it.

In normal use it gets a single-use handle, a typed field or a short-lived private file, so the password stays out of the chat. That is not a promise against an assistant that sets out to dig for it.

Today a connected assistant can recover a password by chaining our own tools, and one with shell access can read the file we write for it. We’re closing the tool route before we invite testers. Until then, scope its vault to what you’d be fine with it seeing.

Today there’s no approval step when an assistant uses a login. Our browser typing tools don’t yet check that the page belongs to the site the login was saved for, and an assistant can change an item’s saved sites. So a hijacked assistant could type a password into the wrong site.

Before we invite testers, assistant fills will be limited to the sites a login was saved for, and changing those sites from an assistant will need your approval. Until then, don’t connect an assistant that browses untrusted pages to a vault holding anything important.

Not yet. On Linux, atlas-vault unlock leaves a key in a file in your home folder until you run atlas-vault lock. Anything running as your user can read it, including an assistant with shell access.

If you run our assistant server as an always-on local service, it accepts any connection from your computer without a token. We’re adding an expiry to that file and a required token before we invite testers. Until then, run assistants as a separate user or in a sandbox, and lock the vault when you’re done.

To find the right login, an assistant sees item names, usernames, website addresses, identity details and notes that don’t look like secrets. So the company running your assistant learns which services you use.

Our note filter misses some secrets, such as PINs, seed phrases and backup codes, so keep those out of notes on items an assistant can reach. Some replies also include a short hash and the length of a value, which someone holding the chat could use to check guesses at a weak password. We’re hiding notes from assistants and switching to a keyed fingerprint before we invite testers.

No. Your device stretches it with Argon2id, at least 256 MiB of memory and 3 passes, and refuses weaker settings even if a server asks for them. It then sends a separate sign-in key derived from it, which can’t decrypt anything. The server stores a hash of that key.

Someone who captured the sign-in key, including Cloudflare, which carries the connection, could try to guess a weak master password offline. Today they could also use it to change your account password or recovery key and lock you out of sync, though not to read your vault. Use a long master password that you use nowhere else.

We do, during the beta, on a machine we operate in Perth, behind a Cloudflare tunnel. It’s a separate service with its own data and keys, but not a dedicated host, and its backups are on the same machine for now.

It sees your email, your devices, how many items you have, their encrypted sizes, when they change and your IP address when you connect. It can’t decrypt your vault, but it could withhold or delete it, so keep an encrypted export.

Partly. On a normal sync, each device remembers the newest version it has seen and refuses an older copy, on Linux, iPhone and the browser extension. A new or reinstalled device has nothing to compare against, and our own review found one Linux sync path that could accept an older signed copy. We’re fixing that path before we invite testers.

Not yet. Atlas Vault is about three months old, and much of it was written with AI coding tools. A change merges when the required automated checks pass, without a second person approving it. The encryption comes from libsodium and the Python cryptography library, not primitives of our own, and every change runs our leak test before it can merge. We’ll commission an independent security review before general availability.

It’s stored in a Supabase database in Singapore with the use you picked, your consent and the time. Cloudflare Turnstile checks you’re a person once you start filling in the form (typing, clicking into the email field or choosing an option, not reading or scrolling past it), and we get a one-line Discord notice with a masked address. To be removed, email contact@atlas-ai.au and we’ll delete your entry by hand. The full list of services is on the Privacy page.