How we keep your data safe

Before we opened Shuriken to everyone, a security engineer looked at it and told us he wouldn't use it. Not because of a bug he'd found. Because the code is closed, and he couldn't tell how his data crosses the network.

He was right that "trust us" isn't an answer. Shuriken holds the keys to a lot: sign-ins for every AI account you add, API keys, MCP sign-ins for GitHub or Notion, and the chats where your agents work on your code. So we did two things. We went through every piece of data Shuriken touches, one by one, and fixed the places where our promises were stronger than the code. Then we wrote down exactly how it works, including the parts that aren't end-to-end encrypted.

This post is the short version. The long one, with the algorithms, is on the security page.

The short version#

Your agents run on your computers and servers. That's where your code lives, and where every chat's history is kept. When an agent talks to Claude or ChatGPT, it goes from your computer straight to that provider, under your own sign-in or key, never through us.

Our cloud does four things: it signs you in, links your devices, relays messages between them, and sends push notifications. The messages it relays are sealed on one of your devices and opened on another. In between, our cloud sees ciphertext.

There's a longer piece on why we built it this way in agents on your machines.

What we changed#

Going through it line by line turned up places where the code didn't yet match what we said. These are the ones we fixed:

• The relay learns less. Between current apps and servers, the size of each message is rounded up to a step, and nothing is compressed before it's sealed, so sizes say less about what's inside.
• Other people on your computer are kept out. If several people have their own user account on one computer, Shuriken now refuses a connection from another user unless it brings a credential, even from the same machine.
• Signing in on a computer that isn't yours. Every browser sign-in asks "Is this your computer?". Answer No, and your account key and chats stay in the open tab only, never on that computer's disk. Your drafts do stay, so sign out when you're done.
• Old password records can't be replayed. Password records from before 13 October 2026 could have been used to sign in by anyone holding a copy of our database. Our cloud has rewritten every one of them, so a copy taken now holds nothing that signs in.
• Counting website visits without a lasting fingerprint. Visitor counts are keyed with a secret that isn't in our database, so a copy of it can't be matched back to addresses.
• Fewer permissions on a Mac. Full Disk Access is optional now. Without it, macOS asks folder by folder. Whatever you grant Shuriken, your agents get too, so granting less is safer.

And where something is still true that you'd want to know, the security page now says so, in plain words.

What our cloud can't read#

These are encrypted on your device with a key the cloud never holds:

• Your chats, the queue, the changes an agent made, and voice: everything that travels between your devices.
• Sign-ins and keys: AI account sign-ins, API keys and MCP sign-ins sit in your vault, encrypted before they leave your device. For MCP sign-ins, the cloud sees a hash and a sealed box, which is also why one sign-in works on all your devices (Global MCPs).
• Names and pictures: project names, device names, pictures and your app settings. A server's name is readable from when it joins until one of your apps seals it, and a few switches our cloud acts on, like the language of its alerts, stay readable.
• Push notifications your computers send. The installed web app gets only the few account alerts our cloud sends on its own, and they name nothing, like "A device is offline".

The relay can neither read nor forge these messages, with one exception: when you add a server by typing its code in an app instead of running the install command, that server takes your account's key from our cloud unchecked. A changed cloud could put itself in between at that moment, so use the install command, which proves both keys.

Your password never leaves your device#

When you sign in with a password, it doesn't travel to us. Your device turns it into a password key, slowly on purpose (600,000 rounds of PBKDF2), and from that makes two things: the key apps sign in with, and a lock on your vault. The vault key itself is random, made on your device. Our cloud keeps it only locked. Since 5.1.1 a passkey or your recovery key can unlock the vault too, and for those our cloud also holds only locked copies.

So someone who walks off with a copy of our database, or anyone who works here, gets ciphertext. What they can do is guess passwords against it, offline, as fast as their hardware allows. If you keep a password, your vault is as strong as it: make it long, and don't reuse it.

What it does keep#

Some things have to be readable for the service to work:

• Your account: email address, first name, plan, the terms you accepted, and billing records. Stripe takes your card; we never see the number. With two-factor sign-in on, its secret too, sealed with a key our cloud holds.
• Your devices: each device's kind, system and rough location, so you can tell "MacBook" from "server in Frankfurt". For waking a computer from another one on the same network, codes that say which of your computers share a network, made with a key only your devices hold; the addresses themselves reach us sealed.
• Which kinds of sources you add: that you have a Claude account or an OpenAI key, not the sign-in or the key.
• Which repository a project is: a fingerprint of its git remote, so a GitHub call reaches it. Its only salt is your account's id, so we could check it against a public repository.
• Who you share with: the address you invite to a project, their role, and which accounts share a project with you.
• When things happen: which of your devices are online, which hours work ran on them (kept two days), and what the relay sees: which devices talk, when, and about how much.
• What you send us: bug reports (with any screenshots you attach) and mail to office@shuriken.sh.

The privacy policy says how long each one is kept.

What isn't end-to-end encrypted#

A few things pass our cloud readable. We'd rather you hear it from us. The security page lists every case, including those that only apply to features still in beta:

• Previews of a dev server. A preview shows a dev server at an address on shuriken.sh, and its pages pass our cloud unencrypted.
• Webhooks. When GitHub calls Shuriken, our cloud receives that message as GitHub sent it. For a computer on 5.1 or later it seals the message to that computer's key before keeping it, so what waits (at most seven days) and our host's restore points (up to 30 days after) hold only ciphertext. For an older computer it holds the message readable that long.
• A reply you type on a notification from an app older than 5.1, or to a computer older than 5.1. It travels like an older computer's webhook. From 5.1 on both ends, your phone seals the reply to your computer's key and our cloud never reads it.
• Bug reports are readable by design: you send them to us.

What your agents can reach#

This one isn't about our cloud. Your agents work on your computer as you, with your access, like a CLI you run in a terminal, and your own chats aren't sandboxed. Where the Shuriken app is signed in, that includes the key that opens your vault. An agent misled by a prompt could read every sign-in in it. Run agents and prompts you trust, as you would in a terminal.

Signed code, and what isn't signed yet#

A changed cloud shouldn't be able to slip code onto your machines. Here's where we stand:

• The desktop apps carry their own code. They never load any from our cloud.
• Servers install and update only signed releases. Every release is signed with a key our cloud never holds, and a server refuses anything that signature doesn't check out for.
• Windows and Linux updates are checked against our signature before they install (since 5.0).
• The Mac app is signed and notarised. Since 5.1 it carries our Apple Developer ID and Apple's notarisation, so macOS opens it without an Open Anyway detour.

And the parts we haven't done, said plainly:

• The Windows installer isn't code-signed yet. SmartScreen may say it protected your PC; More info › Run anyway gets you past it.
• The Linux downloads carry no GPG signature yet. Once installed, the app checks every update against our signature like on Windows.
• Your first download isn't checked against our release key. The installers and the one-line Mac install come from our cloud, so a changed cloud could hand a new user a different installer. Once the app is installed, it checks every update against that key.

When either changes, we'll say so here and in the release notes.

The web app is the honest exception#

The desktop apps bring their own code. The web app at app.shuriken.sh can't: our cloud serves it. A cloud running modified code could, in theory, serve a page that reads what that browser tab holds.

We've made that hard. The web app runs under a strict content security policy, with no third-party scripts and no eval. Every file in it is listed with a fingerprint, and that list is signed with a key that isn't on our servers. The desktop app checks the files our cloud serves against the signed list when it starts and every six hours, and shows a short note if one of them differs.

That's detection, not prevention: a hostile server could still show one browser something different. So our advice is simple. For anything sensitive, use the desktop app.

Why the code is still closed#

We haven't published Shuriken's source, and we know that asks you to take more on trust. What we do instead: the security page describes the design in enough detail to hold us to it, down to the key derivation and the relay handshake, and it lists the exceptions above rather than hiding them. If you find a place where Shuriken behaves differently from what that page says, that's a vulnerability, and we want to hear about it.

Deleting your account#

You can delete your account yourself: Settings › Account › Delete account. We email you a one-time link; open it, confirm, and your account and everything our cloud holds for you is removed. Restore points of our databases age out within 30 days. Billing records we must keep by law stay 10 years, without the link to your account. Mail you exchanged with us stays 3 years, and if you unsubscribed from our news or marked it as spam, your address stays on the list we never send news to.

Found something?#

Write to office@shuriken.sh; it's also in our security.txt. We reply to every report. Please give us time to fix it before you publish.

If this is the kind of setup you want around your agents, try Shuriken.