Why we don't have password recovery (and that's the feature)
Every workspace tool that lets you 'reset your password and get back in' is keeping a copy of your data somewhere they can decrypt. Here's why we made the opposite trade-off.
Every tool that lets you reset your password and immediately access your data is keeping a copy of that data somewhere they can decrypt. That's how password recovery has to work mathematically: if the data is encrypted with a key derived from your password, and you lose the password, the only way to get back in is for the vendor to hold an additional copy of the key.
We chose not to have that copy.
What the trade-off looks like
If you forget your password on Slack, Notion, or Google Workspace, you click 'forgot password,' get an email, and you're back in. Your data was always there — the vendor never lost access to it.
If you lose all your Koaich devices at once and you didn't write down your recovery codes, your data is gone. Permanently. There's no support ticket that brings it back. There's no master key in our office.
Why this is the right trade-off for sensitive work
If we held a master spare, three things would follow: our staff could be compromised; an external request could compel us to decrypt your data; and a breach of our infrastructure would expose your data.
The Shamir-split recovery model gives you a path back as long as you have multiple devices: each device holds a share of the recovery secret. Lose one, recover from the others. Lose all of them at once without backup codes — you've accepted the consequence of true self-custody.
It's the same trade-off self-custodial wallets make for crypto. It's the property that makes 'we can't read your data' honest rather than aspirational.