Security

Not a feature on this page. The reason the page exists.

Your machine has no front door

Nothing in the suite is published to the internet — no public hostname, no open port, no certificate for the outside world to check. Your phone and your server join a private mesh and talk to each other directly, encrypted end to end, wherever either of them happens to be. Everything you own answers only from behind that one perimeter. A machine sweeping the internet for something to break into finds nothing to knock on, because there is nothing there.

One gateway, one URL, and it is yours

All of it — mail, files, photos, the vault, the agent — sits behind a single private address that only your own devices can reach. Behind that address the network itself is yours as well: Headscale coordinates the mesh and Tailscale carries it, both running for you, so no third party learns which devices you own or when they are awake. The one part that must sit on a public address holds only keys and device names — no files, no mail, no wallet, no vault. Where each piece runs is on the server page.

Nothing cached where it can be taken

Credentials live inside the one app and on the server, not scattered across a dozen others. Sign out and there is nothing left on the phone to find — no stale token, no offline copy, no second way in.

One account, which you created

There is no user directory, no recovery flow through somebody's support desk, no telemetry and no plan tier. If your server is off, the suite is off — and nobody else can turn it on.

Kill it in a panic

A stolen phone is one problem; a phone you are being made to unlock is a different one. Biometrics can be held up to your face and a PIN can be talked out of you. So the last control is not one you reach for: with the app open it is listening, and a phrase you chose in advance — said out loud, nothing to tap — ends the session or takes the server down. A phrase rather than a word, so ordinary talk cannot fire it. They differ only in how far they reach: the first costs you a login, the last would cost you the disk.

Distress phrase

Reaches this phone

The lightest of them, and the one to reach for first. It signs you out on the device in your hand and does nothing else: the server keeps running, your other devices stay signed in, no data moves. Whoever made you unlock the phone is left holding an app with nothing behind it, and making you unlock it again gets them no further.

Getting backSign in again. Nothing on the server changed.

Panic phrase

Reaches the Officer server

The Officer process on your server stops. Not your session — the service. Every device that was signed in is signed out at the same instant, and anyone who had somehow gained access loses it with them. From that moment the server answers nothing, from anywhere, and it stays that way. There is no timeout that brings it back and no phone that can start it again.

Getting backSSH into the machine, or restart the process at its keyboard. Nothing on a phone can do it.

Nuclear option

Reaches the machine

The physical machine shuts down — the box at home, or the VPS. Not the app and not the service: the hardware. This is the tier for when the threat is not to your session but to the room the server is standing in. Whoever comes for the machine gets a machine that is off, and a disk that wants your root password before it gives up anything at all.

Getting backPower it back on yourself, and log in as root.

Scorched earth

Reaches the data Not shipped yet

Under consideration, and this page will keep saying so until it is real. A last tier that stops trying to protect the data and destroys it instead: everything held on the server, and on whatever external drives are attached to it. Best-effort by nature — a wipe is racing the hardware it runs on, and no honest version of this claims otherwise.

Getting backNone. That is the entire point of it.

One door, or many — and you hold the key either way

Every service can live inside the one central app, behind a single sign-in, so there is one place a credential ever sits and one place to sign out of. Or you pull the ones you live in out as standalone apps, each its own icon on the home screen. Inside or apart, it is the same server, the same session, and the same account — the one you made, that answers to no one else. Back to the suite.