ShellMate Credential Security and Access Boundaries
Understand where credentials are encrypted, how access is controlled and which responsibilities remain with your team.
Vault secrets and cloud integrations have different boundaries
Saved Vault secrets are encrypted on the client and decrypted locally for authorized desktop use. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge Vault items. Host labels and observed system details are ordinary metadata.
Host labels and last-verified operating-system details are ordinary metadata. A password reset restores account sign-in, not lost vault keys. Device revocation cannot erase information already copied outside ShellMate.
Read the vault and device-trust user guide →Local Vault decryption
Saved Vault credentials are encrypted before synchronization and decrypted locally for authorized desktop use. Protect the desktop, its local key material and recovery backups; encryption does not protect against every compromised-endpoint scenario.
Device and team access
Device authorization and team permissions govern application access. Revocation does not erase information already copied, and application permissions do not replace remote operating-system accounts or network policy.
SSH and AWS access
SSH requires a reachable SSH service and valid remote authentication. AWS Systems Manager is a separate connection workflow with AWS setup and permissions; using ShellMate does not automatically close SSH ports.
Activity and audit evidence
Application session records help establish connection and account activity. Keep host-side logs and the retention controls your organization requires. Confirm the configuration and coverage of any audit export before relying on it.
AI diagnostic context
Credential encryption and AI input have different boundaries. Logs or pasted text can contain secrets. Review diagnostic context and suggested changes, and confirm provider retention and training terms before submitting sensitive data.
Security review and compliance
This page describes product boundaries, not a certification or a compliance determination. Request current evidence for your deployment, including recovery procedures, retention settings and any independently assessed controls.