CloudCMD is in early access — use for testing only. Your vault is zero-knowledge by design: we can't see or decrypt it. Feedback:
CloudCMD

Privacy & Data

What lives in your CloudCMD workspace

Your vault data lives in an encrypted workspace synced to your account. On every device, decryption happens locally with keys derived from your master password. Even we can't see what's in your vault — we can't use, lose, or abuse data that we don't have.

Even we can't read this

Master password & keys

Your master password and the keys derived from it

LocalVault · Argon2id

Your master password — which we never store and only you know — never leaves your device. Neither your master password nor the keys derived from it is ever transmitted to CloudCMD.

Vault secrets

SSH keys, cloud credentials, secure notes

AES-GCM · client-side

Encrypted on device before sync. We store ciphertext only — even we can't decrypt it.

In-session private keys

SSH keys loaded for a connect session

In-memory SSH agent

Unlocked only for that session and kept in memory — never written to disk or shown in the app UI.

Process isolation

Vault crypto and cloud credential handles

Privileged app core

Secrets stay in a locked-down core of the desktop app. The UI never holds raw key material.

Leaves your device when you instruct it to

AI command context

Your prompt plus limited terminal context for command generation

AI assistance (opt-in feature)

Sent only when you use AI help. Vault secrets and credentials are not included.

Cloud API calls you start

Discovery, metrics, SSO, and kubectl against your accounts

AWS · GCP · Tailscale · K8s

Credentials stay in-app; requests go directly to the provider you already trust.

Terminal sessions

SSH, SSM, Tailscale SSH, and Kubernetes exec traffic

Your servers & clusters

Session traffic goes directly to the hosts you connect — never through CloudCMD.

Two kinds of data

Secure Data

SSH keys, cloud credentials, OAuth refresh tokens, notes, and encrypted environment config. Encrypted client-side (Argon2id + AES-GCM) before sync. Even we can't read it. Secure Data is your property.

Service Data

Account email and name, billing records (via Stripe), support messages, and scrubbed crash diagnostics. Needed to run the product — separate from your vault.

What leaves — in plain language

  • Encrypted sync — Secure Data ciphertext goes to Firebase Cloud Firestore (Google Cloud). We never hold the decryption keys.
  • Cloud providers — When you discover servers or open a terminal, CloudCMD calls AWS, GCP, Tailscale, or Kubernetes APIs as you. Those providers already see that traffic under your account.
  • AI assistance — If you use command generation, your prompt and limited context go to the model provider for that request. Vault secrets and credentials are not included.
  • Diagnostics — Crash/error reports after automatic secret scrubbing (credentials, tokens, and key-shaped values redacted).

How secrets are protected

Encryption and decryption run on your device. Your master password — which we never store and only you know — and the keys derived from it are never transmitted to CloudCMD. A breach of our sync backend does not expose your vault in plaintext. Without those keys, we're incapable of reading it.

Zero-knowledge by design

Sensitive vault fields are encrypted before sync. We store ciphertext only — even we can't read your secrets in plaintext.

State-of-the-art encryption

AES-GCM (JWE) with keys derived via Argon2id — a memory-hard function chosen to resist brute-force and GPU attacks. Servers and people can be tricked; cryptography cannot.

Keys stay in a privileged core

Crypto runs in a locked-down part of the desktop app. The UI is sandboxed and never holds raw vault keys.

SSH agent (in memory)

Private keys for a session are unlocked only for that session and kept in memory — not written to temp files. Dropped on session end or vault lock.

Cloud credentials are increasingly confined behind opaque handles in that same privileged core. Desktop releases are code-signed; auto-updates are signed end to end.

Google user data (Google Cloud OAuth)

When you connect Google Cloud with OAuth, you authorize CloudCMD to call Google APIs on your behalf. Our use of that data adheres to the Google API Services User Data Policy, including Limited Use.

  • What we access — your Google account email (to identify the connection), an OAuth refresh token (to mint short-lived access tokens), and GCP resource metadata you ask the app to show (instances, metrics, GKE clusters, projects, and related APIs).
  • How we use it — only for user-facing CloudCMD features you can see in the app (discovery, metrics, IAP/SSH terminals, Kubernetes browsing, commands you approve). We do not use Google user data for advertising, selling, data brokers, credit/lending, unrelated databases, or training AI/ML models.
  • How we store it — OAuth refresh tokens and related session config are Secure Data: encrypted client-side before sync. Access tokens are minted in the desktop app as needed and are not stored at rest.
  • Human access — employees/contractors do not read your GCP API responses or OAuth tokens except for security investigations, legal compliance, or with your explicit permission.
  • Sharing — we do not transfer Google user data to third parties except as necessary to provide the Services (e.g. encrypted sync on Firebase/Google Cloud) or as required by law — never for ads, brokers, or AI training.
  • Revoke anytime — disconnect the GCP session in CloudCMD (Environments → your session → delete/disconnect) and revoke access at Google Account permissions.

Other cloud provider credentials

AWS (including IAM Identity Center SSO), GCP service-account keys and other auth methods, and Tailscale credentials are also Secure Data — encrypted before sync. We use them only for actions you initiate (discovery, terminals, metrics, and related features). We do not share cloud credentials with third parties except as necessary to operate encrypted sync.

Who can access your data

  • You — full access after unlock with your master password on a signed-in device.
  • CloudCMD as a company — Service Data needed to run the product; Secure Data only as ciphertext we cannot decrypt.
  • Providers you connect — AWS, Google, Tailscale, etc. receive the API/terminal traffic you start, under your existing relationship with them.
  • Compulsory process — if we must disclose account data, Secure Data would be provided encrypted; we cannot decrypt it.

Full legal text (rights, retention, international transfers): Privacy Policy. Access model: How access works.