🔐 Security Model – How VaultTerm Handles Your Data
VaultTerm is built around one simple rule:
🛡️ Your infrastructure stays yours.
🚫 No External Services
VaultTerm uses:
❌ No backend
❌ No cloud
❌ No analytics
❌ No telemetry
❌ No ads
There is zero external data flow.
🌐 Direct SSH Connections
All connections go directly:
📱 Android → 🌐 Your Server
No proxies.
No relay servers.
No middlemen.
👤 Connection Profiles
Profiles are stored locally on your device.
They contain:
- Profile name
- Host
- Port
- Username
Nothing is synced or uploaded.
🔑 Password Storage
By default:
❌ Password is not saved
🧠 Exists only in RAM during active session
If enabled in Settings:
🔐 Encrypted using Android Keystore
🗝️ AES key lives inside Keystore
📄 Disk stores only encrypted blob + IV
Plaintext exists only in memory while connected.
Never:
❌ Plaintext on disk
❌ Plaintext in SharedPreferences
🛡️ Host Key Verification (TOFU)
VaultTerm uses TOFU (Trust On First Use):
🆕 First connection
✅ Host key accepted
💾 Key stored locally
🔁 Next connections
🔍 Host key verified
⛔ If changed → connection blocked
This protects against MITM attacks.
🧱 Local-Only Architecture
VaultTerm operates entirely on-device:
✅ SSH handled locally
✅ Terminal rendered locally
✅ Encryption handled locally
No remote dependencies.
VaultTerm is designed for users who value privacy, control, and transparency.
Suomeksi: Tietoturvamalli – näin VaultTerm käsittelee tietojasi