Security

How it works

The agent on your machine opens an outbound connection to our relay and holds it open. Nothing listens on your router, no port is forwarded, and your IP address does not need to be public. Traffic from the internet reaches us first, and we pass it down that connection to the one service you pointed it at.

Your service's HTTPS address is public: anyone who knows it will see its login page. Access is guarded by the service's own login, so use a strong password and turn on two-factor authentication (2FA) - in Home Assistant you find it in your user profile.

What the agent can do on your server

• Connect to one local address that you supplied at install time (for example localhost:8123).
• Open one listening port on our side - only the one assigned to your tunnel.
• Report that it is alive, plus CPU and memory usage if you enable monitoring.

What the agent cannot do

These are not promises but limits enforced by the SSH server configuration. Each one can be verified in the agent's source, which is open.

• It gives neither you nor us a shell on your system. The account the tunnel uses has /bin/false as its shell and a forced command - no command from outside will execute.
• It cannot reach other services on your machine. The SSH server permits remote forwarding only, so the tunnel cannot be used to connect to your database, your NAS or anything else on your network.
• It cannot take another customer's port. Every key is pinned to a single port, so one client cannot hijack another's tunnel.
• It cannot change the address it points at. Remote control of that setting was implemented and deliberately removed: a breach of our database would otherwise let someone expose a stranger's server to the internet.

Encryption

• SSH keys: Ed25519, a separate pair per tunnel, generated when the tunnel is created.
• Private key in our database: encrypted with AES-256-GCM, key derived via scrypt.
• Traffic to you: HTTPS from the browser to Cloudflare, which passes it to our relay; from the relay to your server - inside the SSH tunnel. HTTPS ends at Cloudflare and at the relay, not on your server.
• Agent authentication: key only. Password login is disabled.

What we store about you

The complete list, nothing left out:

We do not store the content of the traffic passing through us, and we do not have your Home Assistant password or the password to any other service - you log in to it directly. One distinction is worth making, though: not storing is not the same as not seeing. The HTTPS connection terminates at our relay (and before that at Cloudflare, which shields the subdomains from attacks), so technically the traffic passes through them in decrypted form. Every reverse proxy works this way, our competitors included. If you want nobody along the path to be able to read the traffic even in theory, you need end-to-end encryption above the tunnel layer.

What if we shut down

A fair question for a service your home access depends on. The answer:

• Your Home Assistant, NAS or whatever else keeps working locally. The tunnel is a way in from outside, not a condition for the service to run.
• You lose no configuration - everything stays on your device.
• You remove the agent like any other program: the add-on in Home Assistant, the container in Docker or the package on Linux. It leaves nothing behind except its config file.
• You can move to Tailscale, WireGuard, Nabu Casa or port forwarding. Nothing ties you to us except a subscription you can cancel.

Found a vulnerability?

Write to [email protected]. We reply within 72 hours. Please contact us before public disclosure - we fix and keep you posted.

In scope: our website, panel, relay and agent. Out of scope: tunnel subdomains, because what is served there are our customers' applications - those are other people's servers and we cannot authorise testing them.