Security overview
How we protect your account and data. See [Security & privacy](/security) for more.
- Device credentials: separate for every device; the private key is generated locally and the server keeps only the public key.
- Sessions: short-lived credentials that renew automatically; revoked immediately on password changes, device removal or bans.
- Nodes: hold only access leases; revocations sync in real time through an event stream.
- Local proxy: listens on loopback only; sharing allows private ranges only and requires credentials.
- Releases: signed release manifest and SHA-256 on the download page; failed client updates roll back automatically.
- Admin: access granted by role and capability; sensitive actions go into an append-only audit log.