Local-first, always
The terminal and all credentials live on your device. Sync is optional and never required. Termique works fully offline.
FIG 1.0 · the stack above
Encryption at every layer.
Four layers, four separate guarantees. Each one holds even if another fails.
- 01
Device layer
AES-GCMCredentials are encrypted in termique's Rust core, never in the app interface, before they are stored or synced. The key is derived locally from your master password.
- 02
Local vault
Ciphertext onlyEncrypted credentials sit in the app's local database. The OS keychain only holds an unlock key, and only if you skip the password at startup.
- 03
Transport
TLS + SSHAll network traffic runs over TLS. SSH sessions use standard public-key cryptography. Nothing travels unencrypted.
- 04
Server layer
Never sees plaintextThe server stores only encrypted blobs it has no key for, including hosts you share with a teammate.
Principles
Six decisions, made early.
Each one shapes what Termique will and will not do, including when you share.
AES-256-GCM encryption
Credentials are encrypted with AES-256-GCM before they are stored or synced. The key comes from your master password and never touches the network.
PBKDF2 key derivation
Your master password is never stored. The key is derived locally with PBKDF2 at a high iteration count, with a unique salt per vault.
Encrypted at rest
Credentials are stored encrypted, in the local database and on our servers. The OS keychain only holds an unlock key, and only if you skip the password at startup.
No clipboard exposure
Termique connects with decrypted credentials held in memory, in-process. Passwords are never written to the clipboard.
Command audit logs
Turn on command logging for a host and every command is recorded with who ran it and when, secrets removed. Useful for compliance, shared hosts and post-incident review.
07 · SHARING
Sharing stays end-to-end.
A host you share is wrapped with your teammate's own key (X25519) before it reaches our servers, the same standard as a host you keep to yourself. We cannot read what you share.
This needs a current build on both sides: desktop v0.6.1 or mobile v2.0.1 and later. Revoking removes their access through Termique within 30 seconds, but a credential they already accepted lives on their device. Rotate it if someone should lose access.
Compliance & auditability
SOC 2 SSH access controls.
Meeting SOC 2 Type II criteria (CC6.1 logical access, CC6.2 credential registration, CC6.3 revocation, CC6.8 access audits) means proving that server credentials never leak into unmanaged developer environments. Termique enforces these boundaries in its architecture.
CC6.1 logical accessCC6.2 registrationCC6.3 revocationCC6.8 audits
Managing multiple SSH keys across devices SSH command audit logs for shared hosts CC6.1Credential boundaries
FIG CC6.1
Key material lives in the Rust keyring layer and never touches the JavaScript heap. Passwords and passphrases are decrypted in memory, only while a connection starts.
CC6.8Command audit trails
FIG CC6.8
Tamper-evident command logs with timestamps, originating host identifiers and executed commands, ready for compliance reviews.
CC6.3Device revocation
FIG CC6.3
Revoke a session or device key from the account dashboard in one click, without cycling authorized_keys on your servers by hand.