Your server keys, locked tight.
Exactly how Conny stores and encrypts the credentials you trust it with, and who can see them (nobody).
How your credentials are protected
When you connect a server, you trust Conny with the keys to it. Here is exactly what happens to them, from the moment you press save.
- Encrypted before it’s ever stored. Your server password or SSH key is encrypted the instant it reaches us, before it touches the database. It is never written down in readable form.
- Locked with a key that lives somewhere else. The encryption key is kept separately from the data it protects, in our secured server environment. What sits in the database is scrambled text that means nothing on its own.
- Unlocked only for the moment it’s needed. When Conny connects to your server, the credential is decrypted just for that connection and used straight away.
- Never shown to anyone. Not in the app, not in chats, and not to our team when we help debug an issue.
The technical details
For anyone who wants to know precisely how it works:
- AES-256-GCM encryption for every server password and SSH key. It’s the same standard banks and governments rely on, and it detects any tampering with the stored value.
- A fresh random IV for every credential, so two identical passwords never look the same once encrypted.
- A 256-bit master key held outside the database, in the server environment only.
- Bridge tokens stored only as a SHA-256 hash. We can confirm a token when your bridge connects, but the original can’t be worked out from what we keep.
- No account passwords at all. You sign in through an OAuth provider such as Google and Discord, so there is no Conny password to guess, reuse or leak.
- HTTPS for everything between your browser and Conny.
You stay in control
- Remove a server from Conny at any time and its stored credentials go with it.
- Update a password whenever you like. The new one is encrypted the same way, replacing the old.
- Give Conny its own SFTP or panel user with access to just the files it needs, and you decide exactly what it can reach.
Reporting a vulnerability
Found a security problem? Email [email protected] with the details and how to reproduce it. Please give us a chance to fix it before sharing it publicly. Security reports go to the front of the queue.
Questions?
If anything here is unclear, or you want to know exactly how Conny handles your servers, ask us. A real person will answer.