How GoTerm keeps secrets

How a secret is stored

Each password and key is sealed with a key of its own. That key is sealed again by a master key kept apart from the database, so a copy of the database alone opens nothing.

• A new key every time a secret is saved again.
• Master keys rotate without opening anyone’s secrets.
• A sealed secret is tied to its own workspace and record: copied anywhere else, it won’t open.

When a secret is opened

The gateway signs in to your server for you, so it opens your key at that moment, in memory, and lets it go once it has signed in.

• That’s why GoTerm never calls itself end-to-end encrypted: the gateway uses your key, for a moment.
• Once saved, a password or key isn’t shown in the browser again. A key GoTerm makes for you can be downloaded once, as it’s made.
• Your personal keys go only to desktops you confirmed, sealed for each one. A team’s never leave GoTerm.

Every device confirmed

A password alone doesn’t let a new browser in. It waits until you confirm it, and you can remove it at any time.

What you can do

• Look at Vault, then Devices, now and then, and remove what you don’t know.
• When a server is rebuilt, Forget its old key under Known hosts, then connect again.
• Share a session read-only unless someone needs to type: the gateway enforces it.
• Replace a key that may have leaked: every host that uses it switches at once.

Good to know

• Your workspace talks to GoTerm directly over TLS. Terminal traffic never passes through a CDN.
• The gateway opens SSH connections to your servers and nothing else, with rate limits and a record of every refused connection.
• Host keys are pinned on the first connect: a changed key stops the connection.
• Session output is kept in the gateway’s memory so you can catch up, not on disk.