The vault has no
web address.
Vault-OS cannot be opened in a browser — not from another machine, and not from the machine it runs on. Access goes through Vault-Ecosystem: a dedicated client that finds vaults on your network, pins their identity, and carries the entire product.
To access the system securely, please open the Vault-Ecosystem client application. Direct browser access to the main Vault UI is not permitted on this network for security reasons.
This is what a browser gets. Every time.
Why not a browser?
Because the browser is the least controllable program on the machine, and the vault's whole proposition is control.
Extensions can read the page
A browser is a large, extensible application. Any installed extension with page access can read what is on screen — including whatever the vault just decrypted. That surface is outside the appliance's control and outside yours.
Pinning only works if it cannot be waved away
Vault-OS presents a self-signed certificate. In a browser that is a warning users learn to click through. In a dedicated client it is a pin — trusted on first use, with any unexpected change surfaced rather than shrugged off.
Habit is the real threat
The realistic failure is not an attacker. It is someone typing the appliance's address into Chrome because that is what they always do. The gate closes that path — including from the machine Vault-OS itself runs on. There is deliberately no localhost exemption.
We are precise about what this is. The gate identifies the client by a header, which a determined person with developer tools could replicate. It is not presented as a cryptographic control, and it is not what stands between an attacker and your data — the encrypted enclave, the licence binding and the role model are. What it reliably removes is the casual path, which is the one that actually gets used.
Not a viewer. The product.
Finds vaults by itself
Nodes advertise on the local network. The client browses and lists what it finds. No IP address, no port, no configuration file.
The whole workspace
Sessions, the document archive and folder explorer, the entity map, workflows, telemetry and administration. Not a cut-down remote view — the entire product.
Group collaboration
Multi-party conversations with the assistant as a participant. Voice notes, video notes and one-time-view media, captured in the client.
Follows the handshake
A vault is plain HTTP while locked and HTTPS once running. The client reads which from the advertisement and follows the handoff instead of failing at it.
Four steps. No addresses.
The vault announces itself
A running node advertises its presence on the local network, including which protocol it is currently serving.
The client browses
Open Vault-Ecosystem on any machine on that network. Available nodes appear in a list. Nothing is typed.
Identity is pinned
On first connection the node's certificate is recorded. Any later change is surfaced, not silently accepted.
You sign in
Password, then a one-time code. One active session per account — signing in elsewhere ends the previous one.
On every machine your people use
Windows and Android are shipping today. macOS, Linux and iOS are in development — and we list exactly which is which, rather than implying a build exists before it does.