VaultGuard Sync (Cloud): using Obsidian

VaultGuard Sync adds protected synchronization, role-aware files, local at-rest protection, permission tools, AI Chat, and a permissions graph to the Obsidian vault you already use.

The VaultGuard shield

Select the shield in Obsidian's left ribbon to open the sync menu. The menu is the quickest place to:

• sign in or sign out;
• inspect connection status;
• start a manual sync;
• open the VaultGuard files panel;
• switch the bound cloud vault; and
• reach settings or administration features available to your role.

The command palette exposes the same core actions under VaultGuard Sync.

Understand the local/cloud relationship

Your Obsidian folder remains the working copy on the device. VaultGuard observes supported changes while Obsidian is active, encrypts supported file bodies before upload, and synchronizes authorized remote changes back to the bound folder.

Important boundaries:

• VaultGuard Sync is separate from Obsidian Sync and Git synchronization.
• Sync is interval-based, not simultaneous live co-editing.
• A permission can prevent a remote action even when a path exists locally.
• Excluded paths and some Obsidian/plugin metadata are intentionally not protected or synchronized by the file-body pipeline.
• Valid time-bounded leases can support limited offline work, but offline access is not indefinite.

Read access indicators

VaultGuard decorates protected files and exposes an access summary for the active note. Depending on your effective access, a file may be:

• hidden or unavailable;
• read-only;
• writable; or
• administrable.

Your effective access combines organization rules, vault membership, the vault role, and any matching path-specific rules. Use Explain permissions when you need to understand why an action is allowed or denied.

Work with files safely

• Let a sync finish before closing Obsidian or switching devices.
• Avoid editing the same note concurrently on two devices.
• Check the VaultGuard status before large imports or bulk renames.
• Use a disposable note after changing a role or path rule.
• Treat a denied action as a security result, not a reason to bypass the protected adapter with an external editor.

Local at-rest protection

VaultGuard can protect supported vault files on local disk while presenting readable content inside Obsidian. This is why a protected Markdown file may look like ciphertext when opened directly from Finder or another editor.

Local protection is scoped: excluded paths, caches, metadata, Local Project Memory Mode content, and safely pending files can remain plaintext. Do not describe the entire Obsidian profile as universally encrypted.

Share a note with a teammate

On VaultGuard Cloud, right-click a file and choose VaultGuard Sync: Copy share link. The recipient must still authenticate, belong to the same vault, and have read permission for that file. A share link is not a public or anonymous download URL.

See Permissions and share links.

Use AI Chat

Open VaultGuard Chat: Open AI chat panel from the command palette or the configured ribbon action. The chat can discuss permitted knowledge, inspect notes, propose edits, and—with confirmation—change content or permissions through governed tools.

The selected AI provider receives the content needed for the requested turn. Use narrow questions for sensitive material and review proposed writes before accepting them. See AI Chat and agent access.

Open the permissions graph

Run VaultGuard: Open permissions graph on desktop to visualize how vault, folder, file, user, and role rules combine. The graph explains the active configuration; it does not itself grant access until you confirm a supported change through the relevant permission workflow.

Troubleshooting

Symptom	Response
Status says logged out	Open the shield and sign in again.
Status says not connected	Confirm the vault binding and internet connection, then retry.
A note is read-only	Open its access summary or permission explanation; ask a vault admin if the result is unexpected.
A remote update is missing	Keep Obsidian active, run Sync now, and check for a conflict or denied event.
A protected file is unreadable outside Obsidian	This can be expected when local at-rest protection is active. Use Obsidian to read it.
AI cannot read a note	The current user or AI lease lacks permission, the path is excluded/hidden, or the selected provider cannot process the requested attachment.