End-to-End Encryption.
AES-256-GCM encryption. Zero-knowledge architecture. Not even we can read your data.
Client-Side Encryption
Your passphrase never leaves your browser. PBKDF2 derives a Master Encryption Key (MEK) that encrypts all memory and notes client-side.
Two layers, one memory.
MCP gives your agent tools to read and write. Turn capture passively records every conversation. Together they build a complete knowledge layer.
Your agent gets 27 tools — write memories, semantic search, explore the knowledge graph, manage sessions. Bidirectional, real-time.
Every conversation is passively captured and processed for knowledge extraction. Via hooks (Claude Code, Cursor, Windsurf) or the ingest API.
Agent Encryption
Agents use wrapped MEKs — the server encrypts on their behalf without ever seeing your passphrase. Agent keys can be revoked instantly.
Zero-Knowledge Architecture
ExoVault servers store only ciphertext. No backdoors, no admin access, no exceptions. Recovery phrases let you regain access if you forget your passphrase.
A codex worth keeping.
Free to start. Encrypted always. Connect your first agent in under a minute.