What Local-First and End-to-End Encryption Mean for Private Notes
Understand how infolio uses local-first storage, end-to-end encryption, and device authentication to protect sensitive personal knowledge.
Quick answer
Privacy is not a single toggle. infolio writes content locally first and encrypts sensitive vault content before it leaves your device, making it useful for offline work and controlled sync.
Local-first starts with availability
Local-first means your knowledge base remains useful on your own device first. Documents, workspace layouts, whiteboards, and vault entries can be opened and edited when the network is unavailable.
That matters when you travel, work on unstable networks, or switch between devices. A knowledge tool should not become read-only because the connection is weak.
End-to-end encryption protects sensitive records
infolio vaults are designed for passwords, keys, accounts, IDs, and private documents. Sensitive content is encrypted on-device before sync, so the cloud stores ciphertext rather than readable text.
This does not replace good device security habits, but it reduces the risk of server-side plaintext exposure. Device authentication adds another layer before sensitive areas are opened or edited.
- Sensitive vault data is handled before leaving the device.
- Viewing or editing private records requires device authentication.
- The sync provider stores and transports data; it should not read private content.
Custom sync sources clarify data boundaries
Some users want the simplest possible sync. Others want their data stored in infrastructure they already trust. infolio supports both the official cloud and custom sync sources for different risk preferences.
When you choose your own OSS, S3, R2, or similar storage, you manage credentials, bucket permissions, availability, and backup. In return, the data boundary is easier to reason about.
Security has to stay usable
Security features that are too hard to use get bypassed. infolio keeps vaults inside the normal knowledge structure, while adding authentication at sensitive entry points.
That makes it practical to keep accounts, keys, private projects, and long-term notes in one knowledge base without treating every page the same way.
FAQ
Does local-first mean there is no sync?
No. Local-first means content works locally first, then syncs when available. You can still use the official cloud or a custom storage source across devices.
What belongs in an encrypted vault?
Passwords, API keys, IDs, account records, private notes, and anything you do not want stored as server-readable plaintext are good candidates for vaults.