Your data is yours. We built Zedlin to keep it that way.

Encryption on your device

Every workspace has its own vault. Servers, keys, snippets, logins and the rest are encrypted on your device with ChaCha20-Poly1305 before they are written to storage or sent anywhere.

What Zedlin Sync can and cannot see

Zedlin Sync stores encrypted items and moves them between your devices. It sees your account's email address, your sign-in methods, how many workspaces and items you have, how large they are and when they change. It cannot see what is inside them: not your server addresses, not your keys, not your passwords, and not even the names of your workspaces.

Your approval devices

A computer in Zedlin can write secrets but can't read them. When it needs one, it asks your approval device: you see which computer is asking, for which record, and approve. On iPhone that is Face ID with keys in the Secure Enclave. A YubiKey asks for its PIN and a touch, and you can add Windows Hello as well. Only an iPhone or a YubiKey can add or remove approval devices, and the list is signed, so the server can't slip a key into it.

Computers are added by scanning a QR code with your iPhone. They have no password of their own to steal: they hold a key in the TPM that can't be copied off the machine.

Vault and server secrets

So that you don't learn to approve without looking, one approval unlocks your vault on that computer until you lock it, for at most 12 hours. It covers logins for the Zedlin app and our Chrome extension. Opening many items in a short time cancels it and asks again. Server passwords, SSH keys and other programs on your computer always ask separately.

If you lose your devices

Any remaining approval device can take over. If you have none left, your master password recovers the account on a new iPhone. Zedlin Sync holds that recovery data for 24 hours first and tells your devices, so you can stop someone else. The master password is stretched with Argon2id. If you lose every device and your master password, your data can't be opened, by you or by us. There is no back door.

Talking to your servers

The everyday tools use plain SSH and install nothing. Host keys are remembered on first connection, and Zedlin stops and asks you if one ever changes. Some optional team modules do put something on a host, and only when you turn them on: connection logs use a small collector you install, file backups copy the restic binary, and private networks install WireGuard.

Team servers

In team mode the Zedlin server runs on infrastructure you control and holds the server credentials, so they don't reach members' devices. Sensitive requests need an approval signed by the member's approval device, which the server itself checks against who asked, from which device and for what. Every request is signed by a key bound to that device, so a stolen token or approval doesn't work on another machine. Access is granted per team and per module, changes are written to an activity log, and sessions can be recorded. Owners and admins can use Direct Connect, typing the credentials themselves.

Where the protection stops

We would rather tell you than let you assume. Malware on a computer that is unlocked can use what you have approved while the approval lasts, and on a personal workspace it could read vault items for the length of the session. A password you have opened can be copied while it is open. And anyone with SSH access to a server can do what that account can do on it, whatever Zedlin shows them.

Reporting a vulnerability

If you find a security issue, email support@zedlin.dev with “Security” in the subject. Please give us a chance to fix it before you share it publicly.