Security
Your keys, under your control
An SSH client holds the most sensitive credentials you own. Here is exactly how SigilTTY stores, protects and moves them.
Credentials live in Keychain
Passwords, private keys and passphrases are stored in the system Keychain — never in plain text inside the app database. If you enable credential sync, regular credentials travel through iCloud Keychain, Apple’s end-to-end encrypted keychain sync.
Biometric-protected keys stay on this device
Any private key can require Touch ID, Face ID or the device passcode before each use. Protected keys are deliberately device-local: they are excluded from iCloud Keychain sync and can only reach another device by re-importing or through Key Handoff.
Hardware security keys need no software private key
From SigilTTY 1.2 you can create a FIDO security key inside the app. The private key is generated by — and never leaves — the hardware: every connection is signed by the key itself after a physical touch, and each key can additionally require its PIN. Nothing an attacker could copy off your device is enough to log in.
Host keys are verified before credentials leave
On first connection SigilTTY records the server’s host key fingerprint (trust on first use). If the fingerprint ever changes, the connection is blocked before any credentials are sent. Jump-host chains verify every hop the same way.
Agent forwarding asks you every time
When a remote host requests a signature through agent forwarding, the approval happens on your device: biometric-protected keys prompt for Touch ID or Face ID, and other keys show an explicit confirmation dialog. No signature happens silently.
Key Handoff: encrypted, local, verified
Key Handoff moves a private key to another of your devices over the local network without ever writing a plaintext file. The channel is established with X25519 key agreement, HKDF key derivation and ChaCha20-Poly1305 encryption, and both sides confirm a 6-digit verification code before anything is transferred.
Agent alerts are end-to-end encrypted
Offline push for AI agents runs a small, checksum-verified helper on your server. Each alert is encrypted on the server to your device’s key (HPKE) before it is sent, and decrypted on your device. The push relay we operate sees only an anonymous routing identifier and ciphertext — no account, no pairing codes — and turning the switch off removes the helper from your server. Both the helper and the relay are open source at github.com/SigilTTY/sigiltty-relay, and security audits are welcome.
Voice dictation goes only where you send it — or nowhere at all
Dictation can run entirely on your device using Apple’s speech recognition, pinned to local processing so a language that cannot run locally fails loudly instead of falling back to a server. Choose a third-party service instead and it is bring-your-own-key: audio streams directly from your device to the provider you configured, and nowhere else. Either way it is processed in memory and never written to disk, your API keys live in Keychain like every other credential, and the transcript is inserted into the terminal without ever pressing Enter for you.
Logs stay on your device — and export redacted
The Log Center records connection, transfer, tunnel and key events to local files that never sync. Exports replace hostnames, usernames and addresses with stable pseudonyms by default — and passwords, private keys and passphrases cannot be written to the log at all: the logging layer has no way to express them.
What syncs — and what doesn’t
Sync is deliberately three-tiered, so the most sensitive material never leaves the device:
| Data | How it moves |
|---|---|
| Server profiles, folders, snippets, forwarding rules, known hosts, AI agent records | CloudKit (your private iCloud database) |
| Passwords, regular private keys, security key handles, voice-service records (with their API keys) | iCloud Keychain — optional, off unless you enable credential sync |
| Biometric-protected private keys | Never synced. Device-local by design; move them with Key Handoff |
| Push decryption keys, logs, per-device choices (active voice service, serial line options) | Never synced — deliberately per-device |
Questions?
Security questions and reports are welcome at support@sigiltty.com.
Put it on every device you own.
SigilTTY is out now on the App Store for Mac, iPhone and iPad — free to download.