Chat histories and API keys are cached locally in localStorage and synced to the Quasar backend (MongoDB). API keys are encrypted with AES-256-GCM before being stored on the server. The app connects to the AI provider APIs you configure and to the Quasar backend for sync and authentication.