Storage follows the workflow
Signing in establishes an account identity; it does not automatically upload every local profile or make the browser an offline workspace. Local credential storage, an enrolled Account Vault and the hosted cloud workspace have different behavior. Use the controls provided for the workflow you intend to use.
| Workflow | What to expect |
|---|---|
| Local workstation | Saves supported profiles and settings on the device. Reusable secrets use the configured vault or operating-system credential store. |
| An already enrolled native Account Vault | Its stored, encrypted data can be unlocked with the required local credentials. Supported edits can wait in an encrypted local queue; publishing them requires current account authentication and connectivity. |
| Local browser credential vault | In deployments using this vault, encrypted credentials remain in browser storage. Configured ciphertext synchronization requires its own authenticated service session and enrolled device. It is separate from the hosted cloud workspace. |
| Hosted cloud workspace | Loads and saves protected workspace data through the authenticated cloud service. A successful save requires a service acknowledgment. |
| Temporary connection | Is not a saved inventory or recovery copy. Its availability depends on the deployment's admission policy. |
The hosted workspace needs connectivity
The hosted cloud workspace does not provide a general offline-mode switch. It does not persist a local workspace cache or durable offline write queue. Do not interpret an open page or unsaved changes still visible in memory as an offline backup.
- Sign in to the intended account and unlock the workspace.
- Make a change and wait for its confirmed save state.
- On a failed or uncertain save, use the offered retry or reconciliation controls before making conflicting changes elsewhere.
- Do not close or reload the page assuming that an unconfirmed change is safely retained for later synchronization.
- Lock or sign out when finished on a shared device.
Changing accounts does not transfer ownership of another workspace. A failed cloud write is not permission to save an unprotected local copy.
Select a native Account Vault for saved hosts
Where these controls are available in the native app:
- Open Settings → Keys & Security and choose Open Account Vault.
- Set up or enroll the intended vault, then unlock it with its vault password and Account Secret, or an already enabled device unlock method.
- Enable Save hosts in Account Vault to use that account's encrypted host catalog on this device. Existing device hosts and credentials stay in their current storage.
- Check the saved-host status after edits. Use Sync saved hosts to request synchronization. An offline or waiting-to-sync status means publication is still pending.
- If conflicts or verification failures appear, open Account Vault and review the offered resolution. A deletion waiting for verification also needs attention there.
Local Vault Sync and encrypted Gist sync continue to use the device's catalog. Selecting the Account Vault does not migrate that catalog or turn on a general storage-mode switch.
Prepare local access before going offline
An existing enrolled vault's local copy is different from the hosted browser workspace. You need that copy and its unlock material on the device before relying on offline access. Merely signing in on a new device does not reconstruct a locked vault or authorize synchronization.
When reconnecting a supported local vault, authenticate to its account before publishing pending changes. Review any reported conflict and its verified remote state rather than assuming the newest-looking timestamp must win. Keep a separate backup and recovery plan.
Cloud-only workspace storage does not mean zero local traces. Active memory, browser downloads, screenshots, clipboard history and extensions are separate concerns. See privacy and trust before working on an untrusted or shared device.