Accounts, Vaults & Multiple Accounts
Add and switch Tempest Cloud or self-hosted accounts, choose personal and shared vaults, and understand sign-out versus removal from this device.
A Tempest account is your identity on a particular Tempest server. A vault is the collection of encrypted documents you are using within that account. Switching accounts and switching vaults are separate actions.
You can keep a personal Tempest Cloud account and a work account on a self-hosted server on the same device. Their tokens, encryption keys, server endpoints and local vault files are kept in separate account storage. Adding a second account and switching between accounts require the multi-account entitlement (Pro); the device's account plans determine whether that feature is available.
Add or switch an account
On desktop, open Settings → Account. The Accounts section lists the accounts on this device, shows each server and marks the current one. Use Add account…, select Tempest Cloud or a self-hosted server, and complete sign-in. Use Switch beside an existing account to make it current. The account menu in the sidebar footer also provides account selection.
On mobile, open More and use the account controls to add or switch accounts. Complete browser sign-in and unlock the account's vault when prompted.
Check the server shown alongside the account, particularly if the same email is used on multiple servers. An identity on Tempest Cloud does not automatically have access to a different self-hosted deployment.
Switching changes the account shown in the app; it does not merge data or import credentials from another account. The native host adjusts foreground syncing to the current accounts. Do not assume all background accounts continue syncing just because they remain in the list.
Choose a vault
In Settings → Account → Active vault, choose the personal vault or a shared vault available to that account. Shared-vault access depends on membership and a key grant; account sign-in alone is insufficient.
Current v3 shared vaults wrap their key for each authorized account's public key. Unlock with your account's Master Password when prompted. A legacy v1/v2 shared vault can instead ask for the shared passphrase supplied by its owner; follow the prompt for that vault.
Shared-vault permissions also determine whether you can edit saved connections. The native vault layer checks those writes, including restores from History, rather than relying only on disabled UI buttons. Permission to connect to a saved host does not imply permission to edit its saved credential record. Such restrictions do not prevent a recipient who can decrypt data from copying it outside Tempest.
Sign out versus remove
Switch account
Select another account; keep the other account registered on this device.
Sign out
Remove sign-in tokens and shared-vault access/cache as applicable; keep the account listed and retain its personal data as a local vault.
Remove from this device
Remove the account registration, its local keys and its local account directory. Data already synced stays on the server.
Sign out is not a local data wipe. The personal vault is retained locally and, when possible, re-encrypted under a device-local key. The next sign-in in that account slot can adopt that local data, including when signing in with a different identity. Use Add account to keep a second identity separate, and Remove from this device when your intention is to discard that account's local data.
Close account-related sessions and let pending edits sync before removal. Shared files still in use by another native process can require cleanup after that process releases them; do not treat sign-out as guaranteed forensic erasure. Copies in clipboard history, exports, recordings and backups are outside these controls.
Desktop and CLI share account state
On the same computer, the desktop app, CLI and MCP share the native account root. CLI changes to the current account, sign-in or removal can therefore affect the desktop app too.
Use an account ID if an email does not uniquely identify the account. --account selects an account for that command; TEMPEST_ACCOUNT is the environment equivalent. See the CLI guide for endpoint configuration and sign-in.
Web Mode account isolation
Each browser session has a scoped account list and current account. It cannot automatically access another browser session's accounts or the backend machine's CLI identity. The standalone backend still runs the vault host and is trusted with decrypted data; see Local Credential Storage.
See also
Last updated