Security

Zync is a local-first desktop SSH workspace. The app does not host your SSH credentials or require an account for ordinary local and SSH work. Optional features create separate boundaries: Sync & Backup encrypts selected data for your Google Drive, while Public URLs is a separate beta sharing service.

Where data lives

Data	Default location	When it leaves the device
Hosts, tunnels, snippets, and settings	Your local Zync data folder	Only when you choose an optional sync or backup action.
Vault passwords and private keys	Optional encrypted Local Vault on this device	Only through an explicit encrypted sync or backup flow.
AI provider API keys	Encrypted Local Vault on this device	They are excluded from credential sync and full vault backup exports.
Sync collections	Your Google account’s hidden drive.appdata area	The collection is encrypted on the device before upload.
Public URL traffic	Your selected localhost port, then the active Zync relay	While you have an active Public URL share.
Optional surveys and feedback	Selected survey answers, text and email you choose to provide, plus the pseudonymous installation ID on survey submissions	Only when you choose to submit an in-app form. The installation ID can correlate survey responses with reported product-use totals. Vault secrets, SSH keys, and terminal contents are not attached automatically.

You control the optional connections

Do not enable Drive Sync, Public URLs, cloud AI, or a third-party plugin unless you want that connection. Zync’s desktop app does not need an account for offline work or normal SSH connections.

Local Vault

Are all saved credentials encrypted?

The Local Vault is optional. Credentials assigned to it are encrypted at rest, but a password saved directly on a host can remain in the local connection record. A local private key remains a file on disk unless you explicitly import it into Vault. Choose Save to Vault or move existing credentials into Vault when you need its protection; see connection authentication.

How is the vault protected?

The optional Local Vault protects stored credentials at rest with Argon2id key derivation and authenticated encryption (AEAD). You set the vault passphrase and receive a recovery key. Zync does not receive or host either one.

Key files stored on disk continue to work without moving them into the Vault. For vault-backed hosts, Zync uses stable credential references rather than putting raw secrets in the host record. Credential revisions can be reviewed and restored without changing that identity.

Remember on this device stores unlock material in the operating-system credential store. Use it only on a personal, trusted device. Anyone with access to your unlocked OS session may be able to use vault-backed connections until you forget the device or the cache expires.

Lost unlock methods

If you lose both the vault passphrase and recovery key, local vault credentials cannot be decrypted. Resetting the vault clears local data and host references, but it does not recover the old secrets.

Google Drive Sync

Drive Sync is optional. Zync encrypts selected records on this device before uploading them to your Google account’s hidden drive.appdata area. The provider collection always uses a separate derived key. The recommended setup can reuse the same passphrase text as the Local Vault, while a custom Google Sync passphrase is available for additional isolation.

Sync is currently manual. Connecting Google or setting up encryption does not automatically upload or restore data. Review the selected domains and any restore preview before applying changes. See Sync & Backup for the current domains and selective host workflow.

Drive Sync OAuth is separate from Public URLs OAuth. A Drive connection does not give Zync access to ordinary visible Drive files, and a Public URLs sign-in does not provide Drive access.

Public URLs

Public URLs is an optional beta SaaS feature, not SSH -L, -R, or -D port forwarding. It uses a separate share account, a localhost-only desktop agent, and a Zync-operated API and HTTPS/WSS relay.

When a share is active, the public link reaches the selected service through the localhost-only agent and Zync relay. Anyone who has the link can use it unless you set the optional share password. Treat the URL as a capability and stop or delete the share when finished. The share remains active while the share agent is running, independent of whether an SSH session is connected.

See Public URLs for setup and lifecycle details.

Plugins and active work

Marketplace plugins do not receive raw vault secrets by design. Review plugin permissions before installing or invoking a plugin that processes local data or makes network requests.

Locking the Vault blocks future AI key resolution. An AI request that already resolved its key can continue until that request or agent run finishes.

Does Zync send usage analytics?

Pseudonymous usage analytics are enabled by default and can be disabled in Settings > General. Reports can include a random installation ID, app version, platform, and daily feature counts. They exclude hosts, paths, commands, credentials, vault contents, and terminal output. See the Privacy Policy for the desktop app, optional services, and website analytics.

Report a vulnerability

If you find a security issue, report it privately to the maintainers instead of publishing exploit details in a public issue. Include enough information to reproduce the issue without including real credentials or private keys.

Related docs

• Vault for passphrases, key files, and recovery.
• Sync & Backup for Google Drive collections and restore.
• Public URLs for localhost sharing risks.