Local-First Notes and Vaults: Understand the Security Boundaries
Separate local availability, encrypted vaults, and cloud sync, and learn which security boundaries to check before storing private notes.
Quick answer
Local-first supports availability on your device, vaults protect sensitive records, and sync transfers content between devices. These solve different problems; ordinary content and vault content should be evaluated separately.
Local-first starts with availability
Local-first means you can open and edit locally stored documents, whiteboards, and password records when the network is unavailable.
That matters when you travel, work on unstable networks, or switch between devices. A knowledge tool should not become read-only because the connection is weak.
Check the scope of vault protection
infolio uses encrypted vaults for sensitive records such as passwords, keys, accounts, IDs, and private documents. Ordinary content and vault content have different security boundaries; consult the current in-app explanation for details.
Before storing sensitive records, check the current version’s unlock method, recovery requirements, and sync scope. Local-first storage or using your own cloud account alone does not establish end-to-end encryption for every type of content.
- Evaluate ordinary documents and encrypted vaults separately.
- Check access and unlock requirements on your current device.
- Verify what sync includes, and manage storage permissions and backups separately.
Custom sync sources clarify data boundaries
Keep editing existing content locally. With custom sync enabled, the app encrypts synced content before uploading it to the storage you configure.
When you choose your own OSS, S3, R2, or similar storage, you manage credentials, bucket permissions, availability, and backup. In return, the data boundary is easier to reason about.
Security has to stay usable
infolio keeps vaults within the same app as other knowledge. Before saving sensitive records, use a test record containing no secrets to check access, sync, and recovery.
That makes it practical to keep accounts, keys, private projects, and long-term notes in one knowledge base without treating every page the same way.
FAQ
Does local-first mean there is no sync?
No. Local-first means content works locally first, then syncs when available. Enable a custom sync source to continue on other devices.
What belongs in an encrypted vault?
Passwords, API keys, IDs, account records, and private notes need a separately evaluated protection method. Check the current vault documentation and recovery requirements before storing them.