Exporting your data
Everything Termuna Cloud holds for your account, in one archive, on demand. No support ticket, no waiting: one authenticated call, or one click in the dashboard.
The server stores ciphertext. Session frames and vault items are sealed on your devices before they touch the network, so the archive contains them exactly as sealed blobs plus your wrapped keys. With your encryption passphrase, your browser can decrypt everything locally - the dashboard's readable export does exactly that, and nothing readable ever exists server-side.
One call
# token auth (a device token from the dashboard's devices page works) curl -H "Authorization: Bearer <token>" https://termuna.com/v1/export -o termuna-export.json
The response is a single JSON file, served as a download
(termuna-export-<date>.json). In the dashboard the same
archive is one click: Account → your data → Prepare archive.
The format
Top-level members of the archive. format is
"termuna-export" and version is 1;
a reader meeting a version it does not know should refuse rather than
guess. Timestamps are Unix seconds; sealed blobs are base64.
| member | contents |
|---|---|
account | Profile: email, name, plan, created-at, verification and 2FA flags. |
devices | Registered machines: label, created/last-used, and the machine's own key wrapped to your account vault (sealed). |
orgs | Organizations you belong to, with your role and join date. |
vault_keys | Your account keypair custody record: public key, the secret key sealed under your passphrase, the KDF and its parameters, and the recovery copy when one exists. |
vaults[] | Each vault with your wrapped vault key, every item's ciphertext verbatim, and deletion tombstones. |
sessions[] | Session metadata (sealed title and name, wrapped session key, device) plus frames[]: every retained history frame, byte for byte as the relay stored it (whole TSP frames, sealed content inside). |
history[] | Your synced command history: each record as the sealed blob your machine wrote it, with the cursor, the machine it came from and the times. Exported on every plan, including a free one holding records from a paid stretch. |
Reading it
The archive alone opens nothing - that is the point. Your passphrase
unlocks the account secret key (vault_keys), which unwraps each
vault key and session key, which open the items and frames. The dashboard's
readable export runs that chain in your browser and saves
plain JSON: connections decrypted, session names decrypted, and terminal
history reassembled per pane. Agent conversation frames are not flattened
into text there; they stay, sealed, in the archive itself.
Export works the same on every tier. Deleting your account is always available right below the export rows - in that order on purpose.