Security at Zync

Your infrastructurestays yours.

Zync keeps everyday SSH work on your desktop. Optional sync and sharing features have clear, limited boundaries.

Data boundaries

Where your data lives.

Your workspace stays local unless you deliberately enable encrypted backup or share a localhost service.

Default

Hosts, settings, SSH sessions, terminal content, and optional vault credentials remain on your machine.

Nothing to enable

Optional

Encrypted backup and sync collections go to the hidden drive.appdata folder in your Google account.

Encrypted before upload

Public URLs Beta

While a share is active, traffic from the localhost port you selected passes through the Zync relay.

Only while active

Protection layers

The optional vault uses Argon2id key derivation and authenticated encryption for credentials at rest.

Passphrase + recovery key

The vault is optional. You can continue using SSH key files stored on disk.

No forced migration

Remembered vault unlock material and Public URLs session tokens use the operating system credential store.

Opt in per device

Marketplace plugins do not receive raw vault secrets by design. Review third-party permissions before installing.

No raw vault secrets

Practical guidance

Save the recovery key offline

Losing both your vault passphrase and recovery key means local vault credentials cannot be decrypted.

Use remembered unlock carefully

Enable it only on a personal, trusted device. Anyone with access to your unlocked OS session may reach vault-backed connections.

Review restore previews

A Drive backup can include related hosts, tunnels, snippets, and credentials. Review the preview before applying it.

Stop public shares when finished

Anyone with the URL can reach the selected service while the share is active unless you set an optional password.

Responsible disclosure

Report vulnerabilities privately to the maintainers. Do not open a public issue with exploit details.