Security

Your code stays on your Mac.

You’re about to hand a squad of agents your codebase — so this page is precise. Most “AI in the cloud” tools ship your code to a server to work. Termary doesn’t. Your code, your agents, and your keys stay on your machine — we carry the ping, never the code.

What crosses the wire — and what never does

Local-first, not air-gapped. Exactly two things ever leave your Mac — both minimal, both token-gated:

Notifications

When an agent needs you, its status + which Mac go Mac → termary.com → Apple Push. State only — never your code or output.

Off-network reach

Away from Wi-Fi, your phone reaches your Mac over a one-tap tunnel — but the terminal itself is sealed end-to-end, so the relay forwards ciphertext it can’t read, straight to the loopback bridge. Still token-gated.

Your code never leaves your Mac

The agent is a plain CLI in a local shell. No cloud IDE, no upload, no server-side copy — your repo and history never move.

Parallel agents are fenced by git

Fan-out gives each agent its own git worktree on its own branch. Nothing lands until you review the diff and merge — and cleanup never force-deletes unmerged work.

The stream is end-to-end encrypted

The live terminal — plus diffs, files, and uploads — is sealed with a key only your Mac and phone derive. The relay forwards ciphertext it can’t read. A fresh key every session (X25519) keeps past sessions private even if a key is later lost.

The agent bridge is loopback-only

The MCP server binds to 127.0.0.1 on a random port, behind a per-session token, and stays off until you flip it on. Nothing on the network can reach it.

Remote control is default-deny

A phone that isn’t the Controller only reaches an explicit read-only allowlist — anything that types, opens, or executes is refused on the Mac itself.

Only one device can steer

The mirror is real control, so it’s locked: one Controller types, the rest watch read-only. The Mac enforces it — no lock, no keystrokes. Take it back with a tap.

Pairing is direct — no cloud

Your phone pairs straight to your Mac by QR. The Mac keeps only a hash of each token; on your network they talk with nothing in the middle.

SSH keys sealed in your Keychain

Saved hosts are AES-GCM-sealed under a device-only Keychain key that never iCloud-syncs. Private keys stay in ~/.ssh; passwords are never asked for.

Voice never leaves your phone

Dictation is transcribed on-device. We get the same text a keyboard would send — never the audio, never a recording.

The website can’t reach your Mac

termary.com is sign-in and plan, nothing more. It has no path to your machine, your terminals, or your agents — entitlement is just a signed token.

The short version

What we can’t see

Not a setting you trust us to leave off — things the architecture puts out of our reach. No toggle exposes them, no support ticket reveals them, a subpoena wouldn’t find them on our servers, because they were never there.

Your code, files, and terminal output. Never uploaded; there is no server-side copy to hand over.
Your keystrokes and the live mirror. Sealed end-to-end with a key only your Mac and phone share — the relay is a blind pipe forwarding ciphertext to the loopback bridge, and it can’t read a byte.
Your diffs and fan-out runs. Computed by git on your Mac and sent to your phone end-to-end encrypted over that same direct connection — never uploaded, never stored server-side.
Your SSH private keys and passwords. Keys never leave ~/.ssh; passwords are never collected in the first place.
Your device tokens. The Mac keeps only a SHA-256 hash — the token itself lives only on your phone.
Your voice. Transcribed on the phone; the audio never leaves it.

Don’t take our word for it — verify it: run lsof -iTCP -sTCP:LISTEN and the agent bridge shows up bound to 127.0.0.1 only. Point a network monitor at Termary and watch your code stay put. The one thing you’ll see leave is a “needs you” ping.

The receipts

Enforcement, not policy.

Every claim above maps to a mechanism, not a promise in a document. The load-bearing ones:

Stream encryption: The live mirror is sealed end-to-end with ChaCha20-Poly1305. Each connection derives a fresh key from an ephemeral X25519 exchange bound to your per-device key — forward secrecy, so recorded traffic stays unreadable even if a key later leaks. The relay only ever sees ciphertext.
Pairing: 6-digit codes expire after 3 minutes and /pair is rate-limited. Every other remote route requires the device token.
Device tokens: Your Mac stores only a SHA-256 hash, compared in constant time. The raw token exists in your phone’s Keychain — nowhere else.
Agent bridge: Binds 127.0.0.1 on an OS-random port with a per-session token in an owner-only (0600) file. Off until you turn it on.
Remote control: Default-deny. Without the Controller lock a device gets an explicit read-only allowlist; input frames are dropped before they reach a shell.
Outages: If the account server is unreachable, the lock keeps enforcing the last-known Controller. An outage can never hand an Observer control.
Fan-out: Each worker gets its own git worktree and branch. Merging refuses a dirty checkout; cleanup uses git branch -d — unmerged work is never force-deleted.
SSH vault: Host list sealed with AES-GCM under a 256-bit Keychain key marked device-only — tamper-evident, never synced to iCloud, fails closed.
Voice: Apple’s on-device speech recognition. The transcript is what a keyboard would have sent; the audio never leaves the phone.

Read the privacy policy for exactly what we store when you sign in, and how to delete it.