What we can see. What we can't.
An honest description of the model, including its limits. If a line below sounds like marketing, it isn't — it is how the code works.
- your password
- private SSH keys
- server passwords and passphrases
- usernames on your hosts
- what you type in a session
- your private key — stored encrypted with a key we don't have
- your e-mail and public key
- host labels, hostnames and ports
- group names and tags
- who connected to which host, when, from which device
- who was given access to what, and by whom
Keys on your device. Ciphertext on ours.
-
01
Your password becomes two keys
Argon2id derives a master key on your device. One half proves who you are to the server; the other half encrypts your data and never leaves.
-
02
Each shared host is its own vault
The vault key is encrypted for each person who should have it, with their public key (X25519). The server stores wrapped keys it cannot open.
-
03
Revoking rotates the key
Remove someone and the vault gets a new key, re-wrapped for everyone else. They keep what they already saw — so we also remind you to change the server password.
-
!
The honest limit of “connect only”
To open an SSH session the member's device must hold the key in memory. The app never shows, copies or exports it, but a determined engineer with debugging tools could extract it. True isolation needs a bastion in the path; we say so instead of pretending.