Security / How lwis protects you

How lwis protects you

lwis puts pictures and notes into places that act on them: your coding agents, agents on your server, other people's phones. These are the protections, and the limits you should know about.

Your captures

End-to-end encrypted. A capture is sealed on your device with a fresh key, and only its recipients can open it. The servers only ever hold ciphertext.
Deleted after delivery. Encrypted images are removed from storage a few minutes after every recipient has fetched them, and never kept more than about a day. Notification (ntfy) messages expire after 12 hours.
No accounts. Your identity is a set of keys on your phone. There are no emails, phone numbers or directories.

Your agent sessions

Nothing reaches a session you didn't attach. A Claude session receives captures only after /lwis:on, when its project is on your allowlist (lwis allow <dir>), or when you start it with LWIS_ATTACH=1.
No surprise turns. By default a capture waits for your next prompt; only sessions attached with --wake start working on their own.
Session replies need your approval. A Claude session's reply waits until you review it in a terminal (lwis replies) and approve it (lwis reply-approve <id> or /lwis:approve-reply <id>), unless you attached it with --allow-replies. A hosted agent's final answer is sent back as is.
Other people never reach your sessions directly. Captures from contacts land in your inbox, unless you let a contact reach a hosted agent (its accept_from, and lwis contacts policy <contact> --agents on). If you forward one, or a contact sends one to an agent you allowed, the agent sees it marked as coming from them, not you, and always in strict mode.
A kill switch and a record. lwis pause (or the switch on your phone) stops all delivery, and lwis log records every delivery (the last 5000 entries).

Your devices and contacts

Pairing and linking need a 6-digit code confirmed on both screens (except the browser extension pairing locally with lwisd on the same machine, which relies on your user account).
Contacts are pinned to their keys. Compare safety numbers in person or on a call to verify someone; until then they're marked unverified.
On Android, your keys are encrypted at rest with a hardware-backed Keystore key, and sending to an agent needs a fingerprint, face or device PIN unlock in the last 5 minutes.

The software you install

Releases are signed with an offline key, which is also published in DNS. The installer and lwis self-update check both.
The lwis binary is reproducible: anyone can rebuild it from the tagged commit and get the same file.
The web app pins the signed release it first saw, and refuses unsigned updates.

See Verifying releases and Pinned web app.

Limits

Metadata. The servers can't read content, but they see who talks to whom and when. See What the servers can see.
Your own captures are your requests. If you capture a page containing instructions aimed at an AI and send it to your agent, the agent reads them. The page text is marked as untrusted, but your agent's own permission prompts remain the last line of defence.
A stolen, unlocked phone can send until you unpair it (lwis devices rm) or pause delivery.
The web app's first visit trusts whatever the server sends; pinning protects later visits.