Security
Credentials stay hidden. Access stays intentional.
SecureTerm is designed around least privilege, encrypted credential storage, and server-side permission checks before every connection.
AES-256-GCM at rest
Passwords, private keys, and passphrases are encrypted before storage and decrypted only inside trusted server code.
Server-side authorization
Every protected action checks session, role, active status, and server assignment on the server side.
Gateway verification
The SSH gateway verifies short-lived tokens and confirms assignment before opening SSH or SFTP.
Instant deactivation
Inactive users cannot sign in and cannot start new terminal or SFTP sessions.
No raw SSH secrets in the browser.
The frontend requests a terminal or SFTP token. The gateway fetches encrypted credentials, decrypts them server-side, opens the session, and streams terminal data over WebSocket.
Audit events that matter.
login
failed login
server update
assignment change
terminal started
terminal ended