Optional encrypted Vault
Vault credentials use Argon2id key derivation and authenticated encryption. A password saved directly to a host record can remain outside Vault; a key file stays on disk unless imported.
Vault guideSecurity at Zync
Your workspace. Your control.
Where your data goes and how it is protected.
Data boundaries
Where your data goes.
Storage, server connections, and optional services at a glance.
| Data or feature | Destination | When it connects |
|---|---|---|
| Workspace & credentials Hosts, settings, and saved credentials. | Your device | Local by default Stored on this device |
| SSH sessions & tunnels Terminal and SSH forwarding traffic. | Your SSH server | Your connection When you connect |
| Encrypted Sync & Backup Selected records in the hidden Drive app-data area. | Your Google Drive | Optional Manual upload or restore |
| Public URLs (Beta) Traffic for your selected localhost port. | Zync relay | Optional While your share is active |
| Cloud AI Requests you send to a configured cloud AI provider. | Your chosen provider | Optional When you use cloud AI |
| Usage analytics Pseudonymous ID, version, platform, and feature counts. Excludes credentials and terminal content. | Zync analytics service | On by default Disable in Settings > General Analytics settings |
Credentials & access
Protection with clear limits.
Unlock and recovery
Losing both your passphrase and recovery key means Vault credentials cannot be decrypted. Remembered unlock uses the OS credential store; an unlocked OS session may allow access until cache expiry or Forget device.
Recovery and resetSeparate sync encryption
Records are encrypted before upload with a separate derived key. Drive authorization is scoped to app data and separate from Public URLs sign-in.
Sync & Backup guidePlugin permissions
Manifest v2 isolates plugins with host-checked permissions. Granted SSH commands run as your server account and can expose sensitive output. Signatures prove provenance, not safety. Legacy Developer Mode plugins use a broader bridge.
Permissions and side effectsPractical guidance
Keep control of access.
Keep your recovery key offline
Keep a safe copy before storing production credentials.
Remember unlock only on trusted devices
Keep remembered unlock off on shared or untrusted machines.
Review restores and permissions
Check restore selections and plugin command or network access.
End shares when you are finished
Disconnecting SSH does not stop a Public URL. Stop the share itself.
Responsible disclosure
Report a vulnerability.
Send security issues privately to the maintainers. Include reproduction steps and the affected version without real credentials or private keys. Keep exploit details out of public issues.