Your server secrets never leave your machine in plain text
Naucturne encrypts passwords, private keys, passphrases and database profiles on your machine before synchronization. The cloud receives those sensitive fields as ciphertext, alongside the connection metadata required to synchronize your inventory.
Encryption happens on your machine
The key is derived from your master password, which is never transmitted. Sensitive credential fields reach the cloud already encrypted.
Your machine
AES-256-GCM encryption with the key derived from the master password.
Plain → EncryptedThe cloud (Supabase)
Stores encrypted sensitive fields plus connection and team metadata, protected by Row Level Security.
Ciphertext + metadataTeammate machine
Local decryption via the team key sealed for that member.
Encrypted → PlainEvery piece of data in its place
Your sensitive access stays with you, encrypted. The rest is limited to what is strictly needed to run the account and subscription.
Your machine
Your master password, decrypted secret fields (in memory, for the duration of a session) and the content of edited files live only on your machine.
Plaintext, never sentSupabase (cloud)
Stores account and connection metadata (server name, protocol, host, port and username), encrypted credential payloads and sealed team keys, protected by Row Level Security.
Ciphertext + metadataStripe
Handles payment and per-seat billing. Your card data is processed by Stripe: it never passes through our servers.
Payment onlyGitLab (registry)
Hosts the application binaries downloaded from the site. No account data is stored there.
App downloadsOn Supabase: ciphertext, not your secrets
Direct database access reveals connection metadata, but passwords, private keys, passphrases and database profiles remain encrypted with a key that only exists on authorized machines.
What the server sees
- Your account, team membership and connection metadata: server name, protocol, host, port and username
- Sign-in and invitation email addresses
- Passwords, private keys, passphrases, database profiles and team keys as unreadable ciphertext
- Subscription status and seat count (via Stripe)
What the server never sees
- Your master password (it never leaves your machine)
- Your servers' passwords, private keys and passphrases in plaintext
- The key that decrypts your vault or the team keys
- The content of the files you transfer or edit
What Naucturne protects you against
No security is absolute. Here, transparently, is what the architecture neutralizes and what stays your responsibility.
What is neutralized
Database leak
A copy of the Supabase database reveals account and connection metadata plus ciphertext; passwords, private keys and encrypted profiles remain unreadable without the corresponding local key.
Network interception
Content is end-to-end encrypted; SSH fingerprint verification (TOFU) blocks man-in-the-middle attacks.
Insider / host access
Neither we nor the host can decrypt your sensitive credential fields: the key only exists on your authorized machines.
Stolen shared vault
Team sharing seals the key for each member (RSA-OAEP): removing a member cuts off their access to future decryption.
What stays in your hands
Your machine compromised
If your machine is infected (malware, keylogger), secrets decrypted in memory become exposed. Keep your machine up to date.
Weak or lost master password
It encrypts everything and is never transmitted: pick a strong one. Nobody, not even us, can recover it for you.
Sudo elevation & open session
A sudo password you enter is kept for the duration of the session. Lock your vault and close sessions on a shared machine.
Multiple layers, not a single wall
From key derivation to the ephemeral PHP gateway, every link is designed to limit damage if something goes wrong.
AES-256-GCM encrypted vault
Sensitive credential fields are encrypted on your machine with a key derived from your master password via PBKDF2-SHA512 (600,000 iterations).
Master password never transmitted
Your master password never leaves your machine. Supabase stores connection metadata plus encrypted sensitive fields; a database leak does not expose the plaintext secrets.
End-to-end encrypted sharing
Team-shared access is protected by a team key sealed for each member (RSA-OAEP 2048). Decryption happens only on authorized machines.
Native system storage
Local secrets use the system vault (macOS Keychain, Windows Credential Manager) via Electron safeStorage.
SSH fingerprints (TOFU)
Naucturne verifies each SSH server fingerprint and refuses the connection if it changes unexpectedly, blocking man-in-the-middle attacks.
Ephemeral PHP gateway
The database gateway script uses a random name and token, and is automatically deleted when the connection closes.
Security worthy of your access
Try Naucturne free for 14 days, no credit card required.