Cloud login
Cloud login is the shared front door for the full KB-1 experience. It answers who is entering, which organization they belong to, and how KB-1 should route that session.
Cloud login does not automatically mean KB-1 stores the vault content.
Cloud login owns
Section titled “Cloud login owns”- User sessions and account identity.
- Organization membership.
- Owner and member roles.
- Signed entry into org vaults.
- Relay routing for self-hosted daemons.
- Hosted lifecycle access for Hosted vaults.
- Presence and collaboration coordination for full-experience sessions.
Cloud login does not own by itself
Section titled “Cloud login does not own by itself”- The durable file home for a self-hosted vault.
- The local daemon state directory.
- Local MCP client configuration.
- Your backup strategy for self-hosted vaults.
Those belong to the vault home and the daemon mode.
Why self-hosted still uses Cloud login
Section titled “Why self-hosted still uses Cloud login”Self-hosted full experience is not the same thing as local-only daemon mode. In self-hosted full experience, Cloud login is still required so teammates and authorized agents can enter through the shared product surface. Your machine continues to run the vault engine.
The open-source daemon has no Cloud user or organization model of its own. By itself, it is local machine or trusted private-network access. Cloud login and relay are what add users, orgs, remote access, and agent access beyond the daemon host.