Security

Trust boundary

The iPhone is a controller and display. Shell commands, repositories, files, AI-tool accounts and processes, configuration, and credentials remain on the host. Terminal contents travel over an authenticated private connection; the founding product has no Terminal iOS vendor relay for customer terminal traffic.

Pairing and access

Pairing is explicit, one-time, short-lived, attempt-limited, and tied to the selected host. The host stores hashes of pairing and device credentials. The iPhone stores its revocable credential in the iOS Keychain.

Anyone with an authorized device can type into the paired terminal with the authority of that host session. Protect the iPhone, pairing QR, host account, and private network accordingly. Revoke a lost or replaced phone promptly.

Persistent sessions

The host owns the running terminal. App closure or network loss disconnects only the phone client; it does not kill the persistent session. On reconnect, the app attaches to the current host screen rather than presenting old output as live.

Customer control

• Terminal content is not uploaded automatically for support.
• Support bundles are created locally and should be reviewed and redacted.
• The app cannot grant host output access to the iOS clipboard; Copy and Paste require an explicit local action.
• Uninstall preserves host state by default; permanent purge is a separate, confirmed action.

No system can guarantee absolute security. If an identity, signature, certificate, credential, or continuity check cannot be proven, Terminal iOS is designed to stop and name the failure.

Read what stays on the host and the privacy policy.