"Local-first" is becoming a marketing word. This guide explains what it technically means — and how Bedrock implements it: SQLite on your disk, AES-256 encryption, no account, and export you can actually use.

The four tests of a local-first app

1. Where does the data live? If the primary copy is on a server, the app is cloud-first with a cache — not local-first.
2. Does it work with the network off? All core features, not a read-only subset.
3. Who holds the keys? Encryption only counts if the key never leaves your device.
4. Can you leave? Export in an open format, without emailing support.

How Bedrock implements each

Storage: one SQLite file

Your workspace is a single SQLite database on disk. SQLite is the most deployed database in the world — it runs in every phone — and it is fast at the read-heavy patterns a workspace app produces. There is no server between you and your data.

Encryption: AES-256, key on device

Workspace data is encrypted at rest with AES-256. The key is derived on your device; there is no account system that could hand it to anyone else.

Identity: none required

Bedrock has no signup. The app works from first launch without an email address, which is only possible because there is no server that needs to know who you are.

Exit: export

Documents export to Markdown; your full workspace exports as JSON. Combined with the SQLite file itself, you are never locked in — the comparison table marks this as a NOW capability, not a promise.

Teams evaluating deployment options should read the enterprise deployment page.