Security
End to end, by design.
Termuna Cloud is built so that we cannot read your sessions. This page explains exactly how, and what the server can and cannot see. When a product handles your terminal, that honesty is the product.
The threat model in one sentence
Assume the relay is fully compromised. An attacker with complete access to Termuna's servers and stored data should still learn nothing about the contents of your sessions. That is the bar we design to.
How encryption works
- Keys are generated on your devices. Each session has a content key created locally. It never leaves your devices unwrapped.
- Frames are sealed before the network. Every output and input frame is encrypted with XChaCha20-Poly1305 using a random 24-byte nonce per message, so nonces never repeat across the host and viewers sharing a session.
- The relay stores ciphertext. Durable history is kept as encrypted frames. The server has no key material and cannot decrypt them.
- Keys travel in link fragments. When you open a session in a browser, the key rides in the URL fragment, which browsers never send to the server. The browser caches it locally so you paste a share link only once.
What the server sees: that a session exists, when it is live, its size in bytes, and encrypted frames. What it never sees: your keystrokes, your output, your scrollback, or your keys. Read the full deep dive on how the encryption works.
The connection vault
Saved SSH connections you sync or share are protected the same way. Each account has a keypair generated on the device; the private key is sealed with a key derived from an encryption passphrase (Argon2id) that never leaves your machine. Each connection is encrypted with a vault key, and that vault key is wrapped to each teammate's public key when you share. To read a shared connection, a teammate unwraps it with their own key. The server stores only ciphertext and public keys, so it can never see a host, a username, a password, or a private key.
Account and access
- Passwords are hashed with Argon2id. We never store them in the clear.
- Device tokens connect a machine's daemon to your account and are stored only as hashes. Revoke any device at any time; its daemon immediately loses cloud access while your local terminal keeps working.
- Two-factor authentication with an authenticator app (TOTP). The setup QR is generated locally, so the secret never transits a third-party QR service; ten one-time recovery codes are shown exactly once; and the last accepted code window is remembered, so a code read over a shoulder cannot be replayed.
- Transport is TLS everywhere, on top of the end-to-end layer.
Local first
The desktop terminal needs no account and makes no network calls unless you turn on sync. There is no telemetry without explicit opt-in. Connection profiles and credentials live in a local vault encrypted at rest with a machine-local key.
Responsible disclosure
If you find a vulnerability, please email security@termuna.com with details and steps to reproduce. We will acknowledge your report, keep you updated, and credit you if you wish once a fix ships. Please give us a reasonable window to remediate before public disclosure.
Questions people ask
Can Termuna employees read my terminal sessions?
No. Termuna cannot read them: session keys are generated on your devices and never leave them unwrapped. Every frame is sealed with XChaCha20-Poly1305 before it touches the network, and the relay stores only ciphertext. We could not read your scrollback if we tried.
What does the server actually see?
Termuna's server sees that a session exists, when it is live, its size in bytes, and encrypted frames. It never sees your keystrokes, your output, your scrollback, or your keys.
What happens if Termuna's servers are breached?
That is the bar Termuna designs to: an attacker with complete access to the servers and stored data still learns nothing about the contents of your sessions, because no key material is there to steal.
Are my SSH passwords and keys safe in the vault?
Termuna encrypts each connection on your device with a vault key, and your private key is sealed with a passphrase-derived key (Argon2id) that never leaves your machine. The server stores only ciphertext and public keys, never a host, a username, a password, or a private key.
Does Termuna support two-factor authentication?
Yes. You can add an authenticator app (TOTP) to your account. The setup QR is generated locally, so the secret never transits a third-party QR service, and you get ten one-time recovery codes, shown exactly once. The last accepted code window is remembered, so a code read over a shoulder cannot be replayed. Google and GitHub sign-ins keep their provider's own second factor.
How do I report a security vulnerability?
Email security@termuna.com with details and steps to reproduce. We will acknowledge your report, keep you updated, and credit you if you wish once a fix ships.