Secure by default.
Fully under your control.
LokaiOS gives you full control over what a plugin can see, do, and access — from strictly isolated to full system privileges.
Native plugins are built and signed by the LokaiOS team. But even then, they always start inside an isolated filesystem sandbox.
Not because we don’t trust them — but because trust is something you build, not assume.
LokaiOS gives you full control over what a plugin may see, do and touch. You decide how far access reaches: from strictly sandboxed to full system privileges.
LokaiOS lives in its own world.
And everything stays there.
LokaiOS doesn’t run as a loose layer on top of your system — it lives in a completely separate environment. A world that is strictly isolated from your personal files, documents and apps.
Plugins, intents and processes always stay within that world, unless you explicitly grant access at the file level.
No implicit access. No hidden permissions. No surprises.
You decide what LokaiOS may see. And what it may not.
Choose exactly what a plugin may do.
Every native plugin starts with a safe base configuration:
From there, you can extend access on your own terms.
Granular access.
Grant only the access that’s needed:
LokaiOS shows you exactly which paths, which actions and which risks belong to each choice.
Full access.
Want a native plugin to behave as a fully integrated part of the system? With one click, the sandbox is lifted and the plugin receives:
It’s your OS — and you set the boundaries.
OS-level transparency.
Every change you make is:
You see exactly what happens, why it happens and what impact it has.
The ultimate isolation.
A dedicated micro-computer for every plugin.
For the strictest workloads, LokaiOS offers a level of isolation that goes beyond sandboxing. In MicroVM Mode, a plugin doesn’t just run separated from the system — it runs in a fully hardware-virtualized environment.
No shared memory. No shared kernel. No shared filesystem. No shared network stack. Nothing.
Every plugin gets its own micro-computer:
It’s like putting a plugin inside a mini laptop, inside your OS.
When to use MicroVM Mode.
MicroVM Mode is designed for situations where “sandboxed” isn’t enough.
How it works.
LokaiOS starts an ultra-lightweight micro-VM with:
The plugin sees only this micro-world. Not your OS. Not your files. Not your network. Not your kernel.
Full control, zero risk.
The strictest model, elegantly packaged. MicroVM Mode is the highest level of isolation LokaiOS offers. Zero-trust, taken to the extreme. But still fully under your control.
For those who share nothing.
Import Mode.
Some users don’t want to give LokaiOS access to any of their files — not even a single directory. That’s why LokaiOS introduces Import Mode.
Instead of granting filesystem access, you can:
LokaiOS sees only what you import. Nothing more. This is maximum privacy, without friction.
How Import Mode works.
Drop a document into LokaiOS
It’s automatically copied to the Import Folder.
LokaiOS processes the document
Within its own world, fully isolated.
You decide what happens next
Keep, delete, export, or reprocess.
No access to your real filesystem. No risks. No compromises.
Security without limitations.
No hidden permissions. No implicit access. No surprises. Just an OS that puts you at the center — with control that normally only exists in enterprise systems, wrapped in an experience as clear and elegant as macOS.