Trust center
What we promise, and where to check it.
The documents behind ZestSSH's security, the controls in place, every outside service we use and what it sees, how long we keep what, and who to write to.
Service status from status.zestssh.com
Reading the record from the status page
Documents
Read the source material. All of it is public.
- Security overview How ZestSSH is secured, topic by topic.
- Security whitepaper Version 3.2.7, October 27, 2026. 18 sections, PDF.
- Disclosure policy How to report a vulnerability, and what we promise in return.
- security.txt Where researchers write, in the standard format.
- Open-source SSH core zest_ssh_core on GitHub, under the MIT license.
- Privacy policy What we collect, and what we never do.
- Terms of service The terms for the app and ZestSSH Cloud.
- Data processing addendum For teams: how we process your team’s data for you.
- Sub-processors Every outside service, where it is, and what it sees.
- Acceptable use Your own systems, or ones you may test. Nothing else.
- Documentation Every screen of the app, explained.
Controls
In place today. Each one explained.
ZestSSH holds no SOC 2 or ISO certification and claims none. These are the controls that are in place, each linked to how it works.
The whitepaper ties every claim in it to the code that makes it true, and the SSH engine is open source, so none of this rests on our word alone.
- Sessions go straight from your device to your hosts In place
- Sync encrypted end to end (Argon2id, AES-256-GCM) In place
- Local database encrypted (SQLCipher) In place
- Secrets sealed again behind the vault In place
- HTTPS only, with HSTS In place
- Two-step sign-in and recovery codes In place
- Rate limits on sign-in, codes and emails In place
- No IP addresses or personal activity logs stored In place
- Daily encrypted backups, with an offsite copy In place
- Account deletion in one step, checked In place
- No card data on our servers In place
- No analytics or crash reporting in the app In place
Services we use
Every outside service, and what it sees.
ZestSSH Cloud runs on servers we operate ourselves. These are the companies whose services ZestSSH relies on. None of them can read your synced vault: it is encrypted on your device before it leaves.
| Service | What it does for ZestSSH | What it sees | When |
|---|---|---|---|
| Cloudflare(privacy policy, opens in a new tab) | Runs zestssh.com and docs.zestssh.com, serves the installers, and sits in front of ZestSSH Cloud, where it ends the HTTPS connection and blocks attacks. | Every request to our sites and to ZestSSH Cloud passes through it, so it sees IP addresses and request details. Request logs are turned off for the two websites, so it keeps no log of your visits for us. Synced vaults stay end-to-end encrypted through it. | Whenever you visit a site or use ZestSSH Cloud |
| Firebase Authentication (Google)(privacy policy, opens in a new tab) | Signs you in, checks two-step sign-in codes, and (for a team with company sign-in) connects to the company’s identity provider. | Your email address, an account id, how you sign in, and your authenticator secret if you turn on two-step sign-in. Its library in the app adds the device model and the days the app was used. | Only if you sign in |
| Google, Apple and Microsoft sign-in | Let you sign in with an account you already have. | That you signed in to ZestSSH with their account. | Only if you choose one of them |
| Stripe(privacy policy, opens in a new tab) | Takes payments on this website, sends team invoices, and runs Business subscriptions. | Your card or other payment details (we never do), your email address, your account id, what you bought and, for a team, the billing email and any purchase order number you give. | Only when you buy on the website |
| App Store and Google Play | Sell the personal plans inside the apps, and deliver the apps. | Their own records of your purchase and download. | Only when you buy or install from them |
| RevenueCat(privacy policy, opens in a new tab) | Confirms purchases from the stores and from Stripe, and tells the app what you own. | An app user id (random before you sign in, your account id after) and the store receipt. On phones and tablets, its library adds the device model, OS version, languages, store country and app version, and on iOS Apple’s per-developer device identifier. | Phones and tablets: when the app opens. Computers: through our server, while signed in |
| Resend(privacy policy, opens in a new tab) | Sends our emails: address checks, password resets, two-step sign-in notices and team invitations. | The address it sends to, and the message with its one-time link (for an invitation, also who invited you and to which team). | Only when one of those emails is sent |
| Backblaze(privacy policy, opens in a new tab) | Holds the offsite copy of our server backups. | Only backups already encrypted with AES-256 on our own hardware. It cannot read them. | Every day |
| Discord(privacy policy, opens in a new tab) | Our community, and where the bug reports and suggestions you send from the app are posted. | What you write in a report, the six facts shown to you before sending, and a screenshot (redacted by default) or a Discord handle if you add one. What you post in the community yourself is between you and Discord. | Only when you send a report or suggestion, or use the community |
Where each one is, and its role
Inside the app, only when you use them
On Android, the QR code scanner is Google's ML Kit, which reports usage metrics to Google (never the image or the code). Voice-to-text uses your device's own speech recognizer. Storage you choose for sync or backups (WebDAV, S3-compatible, Google Drive), clouds you import hosts from and password managers you connect talk to you directly; ZestSSH never receives their credentials. The whitepaper's privacy section lists every request the app makes, and when.
Data retention
How long we keep what.
Nothing is kept longer than its job needs. Deleting your account removes it from ZestSSH Cloud at once, except the purchase records kept for accounting; our backups lose it within 6 weeks.
- Data on your devices
- Until you delete it. We never hold it: hosts, keys, passwords, snippets and settings stay on your devices unless you sync them.
- Your encrypted vault on ZestSSH Cloud
- One copy, replaced on each change, until you delete it or your account. No earlier versions are kept.
- A cloud copy set aside by Reset cloud sync
- 30 days, where nothing reads it, then deleted. Your account cannot be deleted during those days.
- Your account (email address, account id, name and photo address from your sign-in, what you own)
- Until you delete your account. Deletion is at once; ZestSSH 2.1.1 and earlier schedule it 30 days ahead.
- A profile photo you uploaded
- Until you remove it or delete your account.
- Two-step recovery codes
- Only a keyed hash of each, until it is used, two-step sign-in is turned off, or the account is deleted.
- Signed-in devices
- Only the platform and when it signed in. A computer’s sign-in is deleted 31 days after it was last refreshed; a phone’s or tablet’s entry stays until the account is deleted.
- The day you were last in a paid team
- Kept so that you can still read your ZestSSH Cloud copy for 30 days after leaving the team. Replaced each day you are in one; deleted with the account.
- Device approval requests
- 10 minutes.
- Sign-in hand-off codes (signing in a computer through the website)
- 2 minutes.
- IP addresses
- Never stored by ZestSSH Cloud. Rate-limit counters live in memory only, for their window (at most 24 hours).
- Server and website logs
- None. ZestSSH Cloud keeps no request log, and Cloudflare’s request logs are turned off for zestssh.com and docs.zestssh.com.
- Server backups
- Made every 24 hours and kept on a schedule (7 daily, 4 weekly, 1 monthly), so deleted data leaves them within 6 weeks.
- A team’s record, vaults and items
- For the life of the team. A team with no members left is deleted. Record entries that name a member stay for the team’s life.
- Replaced item versions and the trash
- 30 days.
- Team activity
- Off unless the owners turn it on; then at most 90 days, and deleted when it is turned off.
- Team session logs
- Off unless the owners turn them on for a vault; then 30 days, and deleted when they are turned off.
- Email invitations
- 14 days, unless accepted or withdrawn first.
- Invite codes
- As long as the person who made it chose: an hour, a day, a week (the default) or 30 days. We hold only a lookup id, never the code.
- Requests for access
- 7 days.
- Live session shares
- At most 12 hours, and nothing once a share ends.
- A company directory (SCIM)
- Until an owner turns directory sync off, or the team is deleted.
- Private support tickets
- While open, then deleted 90 days after the ticket is closed.
- Bug reports
- Posted on Discord, under Discord’s retention. Our server keeps a copy as a public ticket (never the screenshot, your account or any address) so the answer can be read in the app, and we delete that copy a week after the report is closed, usually because the bug is fixed. Email us to have a report removed sooner, from Discord and from our server.
- Suggestions
- Posted on Discord, under Discord’s retention. Our server keeps a copy the same way, until it is removed: email us to have both removed.
- Purchase records
- Kept as long as the payment provider keeps its record of the payment (Stripe for purchases on this website; the App Store or Google Play for theirs) and as tax and accounting rules require, after an account is deleted too. Our own records hold no email address.
Contact
Questions about security or your data?
Write to support@zestssh.com. A person reads every message. For a vulnerability, follow the disclosure policy: you hear back within 5 business days.
- Company
- Affluent Labs LLC
- Security and privacy
- support@zestssh.com
- Community
- ZestSSH on Discord
- Live status
- status.zestssh.com
Read how it is built.
The whitepaper covers the architecture, the threat model, every primitive, and what ZestSSH cannot do.