In short
- On your Mac, passwords, private keys and API keys are encrypted in HostDock's database. The key is kept only in the macOS Keychain.
- The vault (servers, credentials, port-forwarding rules) is end-to-end encrypted when synced. Our server stores ciphertext and never receives your sync password.
- Cloud Space (notes, scripts, File Station files, appearance) is not end-to-end encrypted. Our server can read it.
- The AI assistant never receives your server addresses, usernames or credentials. Command output is scanned for secrets, best effort, before it is sent to the model you configured.
- Syncing is optional. Without an account, nothing leaves your Mac except your SSH connections and the AI requests you make.
On your Mac
HostDock runs in the macOS App Sandbox and is signed with an Apple Developer ID and notarized by Apple. It can only read files you choose in a file dialog.
Passwords, private keys, passphrases, proxy passwords and AI API keys are encrypted with XChaCha20-Poly1305 before they are written to HostDock's local SQLite database. The encryption key is stored only in the macOS Keychain. Revealing a saved password or exporting credentials requires Touch ID or your Mac password.
SSH, SFTP and TLS are implemented in Rust (russh and rustls). HostDock does not call the system ssh or scp and does not link OpenSSL. On first connect it shows the server's host-key fingerprint, and warns you if it ever changes.
The sync vault
When you turn on sync, your first device generates a random 256-bit data key. Every vault record is encrypted with a key derived from it before it leaves your Mac.
| Record encryption | XChaCha20-Poly1305, random 24-byte nonce per record. The record's ID and the vault generation are bound in as associated data, so ciphertext can't be swapped between records or replayed after a reset |
|---|---|
| Record key | HKDF-SHA256 from the data key |
| Sync password | At least 10 characters. Argon2id (64 MiB memory, 3 passes, 16-byte random salt) turns it into a key that wraps the data key |
| Recovery code | 160 random bits shown once as 32 characters. It wraps a second copy of the data key |
| What we store | Your email, the Argon2id salt and parameters, the two wrapped copies of the data key, and the encrypted records |
| What we never receive | Your sync password, recovery code or data key |
What our server can still see. Each vault record carries a plain label for its kind (server, secrets, credential, forwarding rules, setting), so we can enforce plan limits. That means we can see how many servers and saved credentials you have, plus record sizes and when they changed. We cannot see names, addresses, usernames, passwords or keys.
Deletes need your key. HostDock only removes local data because of a delete record it can decrypt. If a record is simply missing on the server, HostDock treats that as the server having lost it and uploads it again. Older ciphertext replayed by the server is rejected.
Cloud Space is not end-to-end encrypted
Notes, the script library, File Station files and their folders, appearance settings and your profile sync through a separate channel that does not use the vault's encryption. They are protected in transit with HTTPS and stored as-is, which means our server can read and modify them. The app says this when you sign in.
We made this trade-off so Cloud Space works the moment you sign in, without a sync password. HostDock never puts vault data (server addresses, credentials) on this channel, but if you write a password into a note, it is stored unencrypted. Keep secrets in the vault.
File contents go directly between your Mac and object storage through short-lived signed URLs (15 minutes). The bytes don't pass through our API server, and HostDock checks each file's SHA-256 after download.
Your account
- Sign-in uses a 6-digit code sent to your email, valid for 10 minutes. There is no account password to leak or reuse.
- Session tokens are stored on our server only as SHA-256 hashes. Each account can have up to 10 devices, and you can sign any of them out remotely.
- Deleting your account permanently deletes all of its data on our server.
AI assistant and MCP
- The in-app assistant talks to the AI provider you configure. The model sees server names and groups, never addresses, ports, usernames or credentials.
- Before command output is sent, HostDock masks private keys, credentials in URLs, Authorization headers, password and token fields, and common token formats (OpenAI-style sk-, AWS AKIA, GitHub, Slack, JWT). This is pattern matching and can miss unusual formats.
- Conversations are stored on your Mac unencrypted and are never synced.
- The MCP server listens on 127.0.0.1 only, checks a bearer token on every request and rejects non-local Host and Origin headers. Tokens are stored encrypted and never synced.
Known weaknesses
- Your email is the key to your account. Someone who controls your inbox can sign in and download your encrypted vault. They still have to guess your sync password offline against Argon2id, so a long, unique sync password is what protects you. Termius-style vaults share this weakness; HostDock does not have a 1Password-style secret key on top.
- No recovery without your secrets. If you lose the sync password and the recovery code and no device is signed in, nobody, including us, can decrypt your vault.
- LAN access for MCP is unencrypted. If you allow an MCP token on your local network, its traffic is plain HTTP. It's off by default.
Reporting a vulnerability
Email security@hostdock.dev with the details. Please give us a chance to fix the issue before disclosing it publicly.