olace

[ more ]

Security & open source

Olace's promise is structural, not contractual: the system is built so that Olace cannot read your conversations, not merely promised not to.

Paired connections

Every paired connection is end-to-end encrypted between your two devices using X25519 key agreement, HKDF-SHA256 key derivation, and AES-256-GCM. On your local network devices talk directly; away from home an encrypted relay routes ciphertext it cannot decrypt. Your computer never opens a port or accepts an incoming connection.

Encrypted sync

Synced conversations use AES-256-GCM, with keys derived through HKDF and, for your PIN, Argon2id. Your master key is generated on your device and wrapped with a recovery key only you hold; a server-held pepper hardens your PIN without Olace ever learning it. Olace stores only wrapped keys and ciphertext, and the key moves only between your own devices: when you enter your Recovery Key or PIN, or approve a new device from one already unlocked.

Where data rests

  • Desktop and mobile. Conversations, attachments, and the search index are stored on your device and protected by your device's own security (disk encryption, OS sandboxing). Encryption in Olace is aimed at the boundaries: everything that leaves the device.
  • Web. The browser is a shared, scriptable environment, so the web app is stricter: conversations are kept encrypted in the browser database, and your key stays in memory for the session.
  • Olace's cloud. Only ciphertext and wrapped keys for synced data, plus the account basics needed to run the service.

Cloud models

First-party cloud models run with zero data retention and no training on your data. If a model cannot be served under those terms, Olace says so instead of quietly relaxing them. BYOK calls go directly from your device to your provider.

Metrics

Operational metrics are aggregate and privacy-safe: no conversation content, no identifiers. Reliability reporting ("Help improve Olace") is a visible toggle under Settings › Privacy & Data, on by default and yours to turn off. Direct Mode chats emit nothing beyond a mode counter.

Open source

The code you have to trust is public. Olace publishes its data-handling components, including the end-to-end encryption and sync encryption implementations, under the Olace-app organization on GitHub, so the encryption claims above can be checked rather than believed.

Reporting a vulnerability

Security reports go to support@olace.app. Please include steps to reproduce; we respond quickly and appreciate responsible disclosure.