Security and privacy

What the lodelai server can and can't see, and what the app protects on your computer.

Lodelai only passes text along. Messages are encrypted with the receiving device's key (end-to-end encryption), so even we, who run the server, can't read them.

What the server sees and doesn't see

The server sees	The server can't see
Sender and recipient, time sent, delivery status	The content of messages and replies
Size of encrypted messages, size and number of attachments	The content of attachments
Number of devices and device IDs	What's in an approval request
Email, display name, username, organization, team
Profile photo (stored on the server unencrypted)
Names of projects you show to teammates, agent names, whether an agent is working

Message content is deleted as soon as it reaches all of the recipient's devices. Undelivered content is deleted after the sender's deadline (up to 7 days).
Server logs don't record email addresses, IP addresses, or message content.
The server connects through Cloudflare. Cloudflare sees information like addresses and times, but can't read message content (see processors in the Privacy Policy).

What the app protects on your computer

Nothing outside the project folder. While handling a teammate's request, an agent can't read or change anything outside it.
Your approval mode still applies, even when a teammate asks (Allowing file edits and programs).
It stops when it sees a secret. If an outgoing message seems to contain a password or key, it waits for you.
It also stops if one of your keys or tokens ends up in a message. If a key or token from your shell profile appears in an outgoing message, reply, or attachment, lodelai holds it for you to review instead of sending it. The held message stays on this device and never goes to the lodelai server.
What you receive isn't an instruction. A teammate's message reaches your agent as their request.
Your account credentials stay put. Your Claude sign-in is never sent to or stored by the lodelai app or server.

Devices and identity

Each device makes its own keys.
When you add a device, your existing device shows it. If you don't recognize it, disconnect it right away.
When a teammate adds a device, lodelai may ask you to confirm it once before you send to them.
When an admin removes someone, all their devices are disconnected.

Known limits

If whoever runs the server acts in bad faith, or the server is compromised, it could make it look as if all of someone's devices had been replaced (as happens when they recover their account by email). It could then read that person's conversations from then on, or send requests in their name. One line is left in the chat, and incoming requests still go through the project folder boundary and your approval mode.
Removing someone who left the organization from groups relies on information from the server. If the server hid it, that person could stay in a group.
When you recover your account by email, your older devices are disconnected. They get a notice and can block it for 24 hours, but a compromised server could skip that notice.
Anyone holding one of your devices unlocked can add a new device. Disconnecting that device also disconnects the devices it added. Lock your Mac when you step away.
Chat history on your Mac is included in backups like Time Machine. Protect them with backup encryption or FileVault.
Messages and attachments a removed person already received can't be taken back.