Security

Tenax connects your device to a session on a computer you own. This page explains how that connection is protected. Each claim matches the code that ships.

Each device has its own key

Your iPhone makes its key the first time Tenax needs one and keeps it in the iOS Keychain. Each computer makes its own key when you install Tenax. It is saved in a file other users on that computer cannot read. Tenax never sends a private key off the device. Our servers know only the public keys.

Encrypted end to end

Everything between your device and your computer is encrypted with the Noise protocol (Noise_XK_25519_ChaChaPoly_BLAKE2s). That covers shell text, files, and session lists.

Your device knows your computer's public key before it connects. A computer without the matching private key cannot finish the handshake. Your computer accepts only devices approved on your account. It refuses any other key before a session opens.

Tenax tries a direct path first. When there is none, it uses our relay. The relay passes the encrypted bytes along and has no key to read them. You do not open a port on your router.

Approving a new computer

Your device joins your account when you sign in. A new computer joins when you approve it from that device. The computer shows a sign-in code, and you approve it in the app.

Approve only a sign-in code your own computer shows right now. Never approve a sign-in code someone sent you. A computer you approve can open the sessions on your other computers.

A sign-in code expires after 10 minutes. Wrong guesses are limited. You can remove a device or a host from your account in the app.

What our servers see

Our account service keeps your devices' public keys, which ones are approved, their names, models, and operating systems, and the city each one last connected from. It keeps each computer's connection addresses and when it last checked in. It does not keep IP addresses for devices.

The relay sees the two IP addresses, your computer's public key, timing, and how many bytes pass.

Neither one sees shell text, files, command history, or any private key. Your computer encrypts each notification for your device before it is sent. Our servers and Apple deliver it but cannot read it.

The full list is on the Privacy page.

Signed updates

Each release has a list of its files, signed with our Ed25519 release key. Your computer checks that signature and each file's SHA-256 before it installs an update. It never installs an older version.

Report a security issue

Email support@jackolab.com with "security" in the subject. Please do not post details in a public issue first.