Remote connections

SSH and SFTP terminate on the backend. RDP and VNC are brokered through internal guacd. The public marketing site is separate from the authenticated application and has no access to your hosts, sessions or Vault.

Encrypted credentials

Saved passwords and private keys are encrypted in your installation. The database and Vault key material use separate persistent volumes. Protect both: a backup of only one is not a complete recovery plan.

Access controls

Host ownership, direct grants and group permissions control supported actions. The backend checks access rather than relying only on hidden UI controls. Use the least remote-account privilege needed for the work.

  • Protect administrator access and remove unused accounts.
  • Use passkeys on HTTPS or localhost where supported; configure OTP and recovery codes.
  • Review audit logs for recorded actions and results. Terminal input and output are not recorded.

Network and deployment

You control the host network, firewall, reverse proxy and browser access path. Managed private-LAN HTTP is supported; use trusted HTTPS when exposure or your policy requires it. The application does not bundle a reverse proxy or automatically back up your data.

Report a vulnerability

Send a minimal, redacted reproduction to [email protected]. Include the affected version and expected versus actual behavior. Do not send credentials, Vault keys, session recordings or customer data.

Email security Backup and restore