The lock is a passkey, tied to this address, set up once on each device. Your Mac checks it with Touch ID, your phone with Face ID. A recovery code is kept for the day a device is lost. Kairos locks itself when you close it, and asks for the password again every 24 hours.