Privacy and security
How Kazi OS protects your files, account and email: local-first storage, encrypted connections, signed sessions, sharing keys, spam filtering and what data leaves your device.
Local-first by design
Your files are created and stored on your own device, in your browser's private storage for kazios.app. Other websites can't read it. Kazi works fully offline, so your documents don't need to pass through a server to be edited.
When data leaves your device
| You… | What's sent | Where |
|---|---|---|
| Turn on cloud sync for a file or folder | Those files | Kazi's sync service |
| Share a file | That file, protected by a key in the link | Kazi's sharing service |
| Send or receive email | Your messages | Kazi's mail server (mail.kazios.app), and the recipient's server |
| Ask Kazi AI | Your prompt and the content you selected | Kazi's AI service and its AI model provider |
| Create an account | Your handle, display name, a hash of your Master Password, optional recovery email | Kazi's account service |
Nothing else is uploaded.
Your account
- Your Master Password is never stored. Kazi keeps only a secure hash to check it.
- Sessions use signed tokens. Changing your password signs out other sessions.
- Your mailbox has its own password that only Kazi's server knows. Mail apps use separate, revocable app passwords.
Connections
All connections to kazios.app, app.kazios.app, docs.kazios.app and mail.kazios.app use HTTPS/TLS. Email between servers uses TLS whenever the other side supports it.
Email protection
- Spam scoring and virus scanning for incoming mail.
- Verified-sender badges based on SPF, DKIM and DMARC.
- Tracking pixels removed from incoming email.
- Kazi's own mail is signed with DKIM and protected by SPF and DMARC records.
Report a security issue
Email security@kazios.app. Please include steps to reproduce, and give us time to fix the issue before sharing it publicly.