Relic is local-first and end-to-end encrypted. Sync is the one part that touches a server, and that server is yours to run. Point the app at your own box, keep every byte on hardware you control, or let us host it for you. Same open code either way, and it only ever holds ciphertext.
The in-app "Your own server" connect screen ships with the Relic client that's rolling out now. The server and its image are live today.
One container, one volume. Everything (the database and your encrypted blobs) lives in that volume, so it is the only thing to back up. No account, no config file, no external services.
$ docker run -d -p 8787:8787 -v relic-data:/data ghcr.io/relicsync/relic-selfhostThe self-host server is the same server behind Relic Cloud, running from local storage instead of ours. Account-less, zero-knowledge, and boring in all the right ways.
The first device to connect claims the server with a passphrase. Every device after uses the same one. There is no email, no sign-up, no user table. Trust on first use, the way an SSH key works.
Your server runs the exact same encryption as Relic Cloud: XChaCha20-Poly1305 with an Argon2id-derived key that never leaves your device. The server stores sealed bytes and could not read them if it tried.
It is the same code we run in the cloud, so nothing about your vault is proprietary to one host. Move from your server to Relic Cloud, or the other way, whenever you want.
On your home network it just works. To reach it from outside, put it behind a tunnel like Tailscale or run it on a small VPS. No ports to poke in your router if you would rather not.
End-to-end encryption is only as good as the code you can check. Relic's client encryption is published as its own small, pure-Dart library. Read it, and run its test suite against pinned vectors to prove the sealed bytes match, byte for byte.
Free forever. One Docker command, your hardware, your data. The whole server is open source.