For the technical
The architecture
AIOS is a desktop application, not a browser tab pointed at someone else’s cloud. It runs its own local database, its own local vector store, and its own local model runtime. Nothing is sent anywhere unless you explicitly ask it to be.
The shell
A Tauri v2 desktop app (Rust + React + TypeScript) wraps a FastAPI sidecar running locally on your machine. The two talk over a local HTTP bridge secured by a per-launch random token and a host-header guard, so a stray webpage in some other tab can’t drive your own backend.
The data plane
SQLite
Chat history, documents, plans, agent runs, and settings — a single local database file, not a hosted table you don't control.
ChromaDB
Semantic search over your own ingested corpus, embedded and stored locally alongside the rest of your data.
OS keychain
API keys and the license token are routed through your operating system's own credential store — never a plaintext database column.
Local inference
Ollama runs models on your own hardware behind a single-worker scheduler, so local VRAM never gets over-committed. Bring your own API keys for frontier models when you want them — AIOS doesn’t require a subscription to a hosted model to be useful.
Trust controls, specifically
The privacy claims on the homepage aren’t a mission statement — they map to specific, checkable controls in the code.
Per-launch token
A fresh random token gates every local API call, so a stray webpage in another tab can't drive your own backend.
OS-keychain routing
API keys and the license token go through your OS credential store, not a database column — nothing sensitive sits in plaintext on disk.
Hard cost-cap kill switch
Spend is metered token-by-token, mid-stream, on every model call — a cap breach terminates the stream rather than silently overrunning.
Approval-gated coding agent
The agent bridge only runs inside an explicit allow-list of repos, with a scrubbed subprocess environment, and only after you approve the generated plan.
Prescreened sandbox
Generated scripts are statically screened for network, filesystem-escape, and destructive calls — re-checked server-side every time, regardless of what the client claims.
Offline verification
License tokens are Ed25519-signed and verified entirely offline against a public key baked into the build — no runtime phone-home required to know what tier you're on.