Local-first
by design.

Where your data goes

Five lanes. Everything on this page is a detail of one of them.

1. Stays on your computer. Workspace, memory, conversations, materials. Your keys sit in the system keychain.
2. To the model you chose. When a teammate answers, its prompt, the memory that fits, its assigned documents and your key go straight to that teammate’s provider. If web search is on, the same provider runs the search.
3. To the runtime for Lorah’s own jobs. Sync, room decisions, Ask Lorah, Today’s brief, and the Compiler with your brief and files. Anthropic, OpenAI, or a local model. The Compiler names the runtime and asks before it sends.
4. Operational. The license check (five fields), the update check, and crash reports only if you switched them on.
5. Only when you ask. Read a link: Lorah fetches that page from your computer. MCP: traffic to that connector. Export: a file you keep.

What’s on your machine

Lorah is a desktop application. Your workspace lives on disk where you installed it. That includes:

• Every teammate’s identity, system prompt, and conversation history
• Every memory entry — facts, decisions, glossary — and the provenance link back to the conversation that produced it
• Every document in Materials
• Every sync run, room transcript, and task result

Lorah’s servers do not host any of this. There is no “cloud account” you can log into to see your workspace from another device, because we don’t have it.

Bring your own key

You provide your own API keys for the model providers you want to use.

• Keys are stored locally, encrypted with AES-256-GCM via your operating system’s keychain (macOS Keychain or Windows Credential Manager).
• Keys never leave your machine.
• When a teammate uses a model, the call goes from your machine directly to the provider’s API. Lorah’s servers are not involved.
• You pay the provider at the provider’s published rate. Lorah adds zero markup on inference.

The cost of running Lorah is whatever your model providers charge you. We don’t see it, we don’t take a cut.

What model providers see

When a teammate makes a call, the model provider (OpenAI, Anthropic, Google, Perplexity, xAI) sees:

• The prompt being sent
• The model name being requested
• Your API key (as authentication)
• The completion they generate, on its way back

This is unavoidable — model inference happens on the provider’s servers. Lorah does not see this traffic because it goes directly from your machine to the provider.

If you’re sensitive about what reaches a given provider, your two levers are:

1. Don’t enable that provider in Settings. Lorah won’t call them.
2. Use a different provider for sensitive teammates. Each teammate is bound to one provider at a time.

What Lorah’s servers do see

Lorah’s servers handle two things, and only two things:

1. Licensing. When you sign in or refresh your license, Lorah checks license.lorah.ai to confirm your subscription is active. The license service stores five fields and only five: your email, your Stripe customer ID, your plan type (monthly or yearly), your subscription status, and the date. About once a day the app checks in to confirm the license is still valid; that check carries a random install id, the app version, your operating system, your license type, and an approximate country — never your IP address, and nothing about your work.
2. Software updates. Lorah checks for new releases periodically. The update check is a standard HTTPS GET to a release server. No workspace content is sent.

No logging of prompts or completions. No error reporting that captures conversation content.

Crash reporting is off by default. If you turn it on, at first run or in Settings → Data & Privacy, Lorah sends short content-free reports: the error type, your app version and platform, and whether a sync succeeded or failed. Never chat content, memory, file names, prompts or API keys. You can read every queued report in Settings before it’s sent. Two further switches, also off by default: a redacted diagnostic snapshot, and linking reports to your install’s license.

There is no “Lorah cloud” that stores your workspace, mirrors your memory, syncs your teammates across devices, or trains any model on your data.

License and billing are separate from your workspace

License and billing live on a separate Cloud Run service at license.lorah.ai. It handles:

• Stripe checkout for Lorah Pro
• Stripe Customer Portal (manage card, change plan, cancel)
• License validation when Lorah checks in

It does not have access to your workspace data, because that data never leaves your machine.

If you cancel, your workspace is never touched and never removed. You drop to the Free-tier limits going forward, but every teammate, every memory entry, every conversation you’ve already built stays exactly where it is.

Export anytime

You can export your entire workspace at any time. The export is a portable archive of your teammates, memory, conversations, and library docs.

You own your data because it’s already on your machine.

MCP connectors

Lorah can connect to MCP servers — Linear, GitHub, Anthropic’s own, and any other MCP-compatible service. When you enable a connector, Lorah’s MCP traffic for that connector goes to that service.

This is opt-in: nothing is connected by default. You choose what Lorah talks to.