olace

[ more ]

Security & open source

Olace's promise is structural, not contractual: the system is built so that Olace cannot read your conversations, not merely promised not to.

Paired connections

Every paired connection is end-to-end encrypted between your two devices using X25519 key agreement, HKDF-SHA256 key derivation, and AES-256-GCM. On your local network the two devices talk directly: the daemon listens on a LAN port that only paired devices can use, and every frame is encrypted. Away from home an encrypted relay routes ciphertext it cannot decrypt, and your computer accepts no inbound connection from the internet.

Encrypted sync

Synced conversations use AES-256-GCM, with keys derived through HKDF and, for your PIN, Argon2id. Your master key is generated on your device and wrapped with a recovery key only you hold; a server-held pepper hardens your PIN without Olace ever learning it. Olace stores only wrapped keys and ciphertext, and the key moves only between your own devices: when you enter your Recovery Key or PIN, or approve a new device from one already unlocked.

Where data rests

  • Desktop and mobile. Conversations, attachments, and the search index are stored on your device and protected by your device's own security (disk encryption, OS sandboxing). Encryption in Olace is aimed at the boundaries: everything that leaves the device.
  • Web. The browser is a shared, scriptable environment, so the web app is stricter: conversations are kept encrypted in the browser database, and your key stays in memory for the session.
  • Olace's cloud. Only ciphertext and wrapped keys for synced data, plus the account basics needed to run the service.
  • A host you rent. Renting the machine changes none of the cryptography above: pairing is end-to-end encrypted and Olace still stores only ciphertext. It moves the trust boundary at the far end, because the provider holds that disk and the memory the model runs in. See Hosting on a machine you rent.

Cloud models

First-party cloud models run with zero data retention and no training on your data. If a model cannot be served under those terms, Olace says so instead of quietly relaxing them. BYOK calls go directly from your device to your provider.

Metrics

Operational metrics are aggregate and privacy-safe: no conversation content, no identifiers. Reliability reporting ("Help improve Olace") is a visible toggle under Settings › Privacy & Data, on by default and yours to turn off. Direct Mode chats emit nothing beyond a mode counter.

Open source

The code you have to trust is public. Olace publishes its data-handling components, including the end-to-end encryption and sync encryption implementations, under the Olace-app organization on GitHub, so the encryption claims above can be checked rather than taken on trust. The transparency repo holds the security white paper (threat model, what the server stores, zero-knowledge backups, pairing, metrics, retention, and known limitations), the cross-implementation test vectors, and the full disclosure policy.

Reporting a vulnerability

Security reports go to security@olace.app. Include steps to reproduce and your assessment of the impact. You will receive an acknowledgment within 3 business days and an assessment within 14 days, and we ask for up to 90 days to ship a fix before public disclosure. Good-faith research against your own accounts and devices is welcome; the full policy, including safe harbor, is in SECURITY.md.