Security that comes from having nothing to secure
GateShell has zero backend servers. Your credentials are stored in the same hardware encryption that protects Apple Pay. SSH sessions go directly from your device to your server. AI runs on-device. There is no infrastructure for an attacker to target, and no third party that can access your data.
Zero Backend Architecture
GateShell has no cloud infrastructure, no relay servers, and no API servers. Every SSH connection goes directly from your device to your server. If there are no servers to breach, there is nothing to breach.
Hardware-Backed Encryption
All passwords and SSH keys are stored in the Apple Keychain, encrypted with AES-256 by the Secure Enclave. Private keys are generated on-device and never become extractable.
Verified Host Keys
GateShell pins your server's host key on first connect and verifies it on every subsequent session. If the key changes, the connection is blocked and you're warned — stopping man-in-the-middle attacks before they start.
Data Security & Privacy
Credential Storage
Passwords, passphrases, and SSH private keys are stored exclusively in the Apple Keychain — hardware-isolated, AES-256 encrypted storage. Keychain items are tied to your device passcode and the Secure Enclave. Even if raw app data is extracted, credentials remain inaccessible without biometric or passcode authentication.
- AES-256 encryption via Secure Enclave
- Biometric-gated access (Face ID / Touch ID)
- Isolated from app sandbox and other applications
- iCloud Keychain sync with E2E encryption (optional)
Data in Transit
All SSH connections use the SSH2 protocol with modern key exchange algorithms (curve25519-sha256, ecdh-sha2-nistp256). GateShell enforces strict host key checking and blocks connections when keys don't match. There are no intermediate servers, relays, or proxies — your session runs directly from your device to your server over an encrypted SSH tunnel.
- SSH2 with Curve25519 key exchange
- Strict host key verification (TOFU pinning)
- No relay servers — direct device-to-server connection
- TLS 1.3 for App Store communication (StoreKit)
Data at Rest
Server configurations and snippets are stored in SwiftData and encrypted via Apple's Data Protection API (NSFileProtectionComplete). Session logs, if recording is enabled, are stored in the app container with the same file-level encryption. No data is ever written to shared or unencrypted storage locations.
- NSFileProtectionComplete for all app data
- Session logs encrypted at rest in app container
- No plaintext credential storage — ever
- Data deletion on app removal (no residual data)
Data Collection
GateShell collects zero analytics, zero telemetry, and zero crash reports. There are no third-party SDKs, no advertising identifiers, and no tracking frameworks in the app. We do not know who uses GateShell, how often, or which servers they connect to. This is not a policy — it is an architectural consequence of having no backend.
- No analytics SDKs
- No crash reporting frameworks
- No advertising identifiers
- No user accounts or email database
App & Platform Security
Biometric App Lock
GateShell requires Face ID or Touch ID authentication on app open. Biometric data is processed entirely on-device by Apple's Secure Enclave — GateShell receives only a boolean response from LocalAuthentication. The app locks immediately when backgrounded. Failed biometric attempts fall back to the device passcode, which is also enforced by the system.
- Face ID / Touch ID required on app open
- Immediate lock on background
- Secure Enclave processes all biometric data
- Configurable auto-lock timer
On-Device AI (Apple Intelligence)
GateShell's AI features — command composition via voice or text, dangerous-command guardrail, secret and PII redaction, and plain-English command explanations — run entirely on-device using Apple Intelligence and FoundationModels. The Intelligence module carries a zero-networking invariant enforced in CI: any networking symbol in the source tree fails the build. Your terminal data never leaves your device for AI processing.
- 100% on-device inference via Apple Intelligence
- CI-enforced zero-networking in AI module
- Guardrail classifies command risk before execution
- PII/secret redaction before session logging
Secure Development
GateShell is built with Apple's Swift programming language using memory-safe patterns. Dependencies are pinned to exact versions and reviewed during updates. The codebase follows Apple's Secure Coding Guide and uses Swift's type system to prevent common vulnerability classes like buffer overflows, use-after-free, and format string attacks.
- Memory-safe Swift throughout
- Pinned dependencies with manual review
- Apple Secure Coding Guide compliance
- Static analysis via Xcode Analyzer on every build
Payment Security
All Pro subscriptions are processed exclusively by Apple via StoreKit. GateShell never receives, stores, or transmits your credit card number, billing address, or purchase history. Apple provides only an anonymized transaction identifier and subscription status. Apple's PCI-DSS compliance governs all payment processing.
- Apple StoreKit processes all payments
- No credit card data touches GateShell
- Anonymized transaction identifiers only
- Managed via Apple ID subscriptions settings
Session Recording Privacy
Terminal session recording is opt-in and disabled by default. When enabled, recordings are stored exclusively in the app's local container with the same file-level encryption as all other app data. Recordings never leave your device unless you explicitly export them via the share sheet. You can delete recordings at any time.
- Opt-in only — disabled by default
- Stored locally with file-level encryption
- No automatic upload or sync
- User-controlled export and deletion
Infrastructure & Network Security
No Infrastructure to Secure
GateShell operates no cloud infrastructure. There are no AWS accounts, no VPCs, no databases, no API servers, no load balancers, and no bastion hosts for an attacker to target. Your SSH sessions are direct device-to-server connections. We cannot intercept, log, or observe your traffic because there is no infrastructure in the path to do so.
iCloud Sync (Apple E2E Encryption)
Server configs and snippets sync via iCloud private database with end-to-end encryption. Data is encrypted on your device with keys derived from your Apple ID credentials. Not even Apple can read synced data. This is the same infrastructure that protects Apple Pay, Health data, iCloud Keychain, and Safari passwords.
No Third-Party Services
GateShell has no third-party service dependencies at runtime. No analytics providers, no crash reporters, no ad networks, no CDNs, no authentication services. The app communicates exclusively with your servers over SSH and with Apple's StoreKit and iCloud services — both governed by Apple's security and privacy guarantees.
Report a vulnerability
If you discover a security issue in GateShell, please email us at support@heftyinnovations.com. We take every report seriously and will respond within 72 hours. Please include detailed steps to reproduce so we can validate and fix the issue quickly.
GateShell does not currently operate a public bug bounty program.