Security

Lorca uses a local key pair for identity and end-to-end encryption to sync data between paired devices. The relay stores public keys and ciphertext.

Your identity is a key

Creating an identity makes a 32-byte secret on your first Device. Everything else is derived from it. The backup phrase is that secret written as thirteen groups of four characters.

• The secret stays on the device that created or restored it.
• Whoever holds the phrase holds the account. Lorca cannot recover it for you.
• The account key the relay keeps for a restore is signed by your identity, so the phrase restores only the key you made.

What is encrypted

Everything with meaning: bot names and descriptions, chat titles, messages, attachments, device names, provider credentials, skills, tasks, group projects, items waiting for review, the Attention list, and the contents of push notifications. Each is encrypted on your device with your account key (XChaCha20-Poly1305) before upload. Work sent to a bot on another computer, an answer to a secret's card, and an event that starts a bot's work are sealed to that computer's public key, so only it can open them.

What one of your devices sends another (a bot's turn, a change to a computer's plugins, MCP servers, or secrets, and the answer) is also signed with the sending device's key. A device acts on it only when a device in your list signed it for that device, and only once, so the relay can't make up work for your computers or send the same work again.

What the relay sees

A pull request watch and a routine's webhook are the exception: see Webhooks.

Devices prove who they are by signing a challenge with their key. There is nothing to phish.

Pairing

A pairing code carries a one-time public key. The new device sends its keys, and a one-time reply key, sealed to that one-time key; the existing device answers with the account key encrypted under the reply key. The relay passes both messages without being able to open either, and can't write a reply the new device would accept. A code expires after ten minutes or when you cancel it.

Any paired computer can pair a new device. Every paired device shows in your device list, one that never says what it is as Unknown Device, so you can unpair a device you don't recognize.

Shared links

A bot you share as a link is encrypted with a key of its own, which is part of the link after the #. Browsers never send that part, so the relay and lorca.app store and serve ciphertext they can't open; the page decrypts it in the browser of whoever opens the link. Anyone with the whole link can read the template, and revoking the link deletes it from the relay. A template saved as a file is not encrypted.

Unpairing

Unpairing a device makes the relay refuse its key for good, and your other devices remember the key as unpaired, so no relay can bring the device back. The device deletes its keys, credentials, and chats the next time it connects.

Your account also gets a new key, made by the device that holds your backup phrase's secret once it is online, and sent to every device but the unpaired one. Whatever you write from then on is encrypted with it, so a device that was unpaired but kept its copy of the old key can't read it, and what it writes is ignored. It can still read what it could before, so if it held API keys you connected, change them at the provider.

Deleting your account

Settings › Advanced › Delete Account in the desktop app removes everything the relay holds for the account (chats, attachments, bots, provider credentials) and unpairs every device, which then deletes its own copy.

Lorca's relay also lets go of an account nothing has touched for a year: no device connected, nothing synced. Your devices keep what they have, and the first one that comes back registers the account again.

On your computer

• Keys, credentials, and chats are files under ~/.lorca/, readable only by your user.
• Bots run as your user and shell commands retain that user's full computer access after Auto-review allows them. See Tools.
• A bot's Access limits which plugins and tools it may use, and can turn off its file and shell tools. It limits Lorca's tools; it is not a sandbox of the operating system. A bot with shell access can reach whatever your user can, so a bot that must be kept apart belongs on a Runner of its own.
• Plugin secrets and sign-ins stay on the Runner where the plugin is installed, and so do a bot's browser profiles and their sign-ins.
• Secrets a bot asks for are encrypted on its Runner, used by name, and kept out of chats, drafts, and what the AI provider sees.
• The local service only takes clients on this computer that hold its token (serve-token in ~/.lorca), so a web page you visit can't reach it.
• Bot memory is scrubbed of anything that looks like a credential before it is written.
• The desktop app talks only to its own local service on 127.0.0.1. That service is the only thing that talks to the relay and to AI providers.

What AI providers see

A bot's turn sends the conversation, its description, and its tool results to the provider you connected, under that provider's terms. That traffic goes straight from the Runner to the provider, never through the relay. Saved secrets are replaced by their names before a tool's result reaches the provider.

Webhooks

Services send webhooks unencrypted. For a pull request watch and a routine's webhook, Lorca's relay receives them: it checks GitHub's signature or the routine's key, encrypts the event for the routine's Runner, and keeps only the encrypted copy, so it reads each request while it does that. For each such routine it keeps the pull request it watches, which of your computers runs it, a hash of the webhook's key, and the secret it signs the routine's events with, all deleted with the routine. To keep a service's requests off Lorca's relay, you can receive them yourself.

Updates

The macOS app is signed and notarized. The Mac, Windows, and Linux apps verify each update against a signing key built into the app before they install it.