Non-Custodial Pledge
Our formal engineering and organizational commitment that Cockpit can never access, read, decrypt, or export your server credentials or private keys.
"We believe security should be guaranteed by mathematics, not corporate promises. Cockpit is built so that even if our entire company, databases, and infrastructure are subpoenaed, coerced, or compromised, your server private keys remain mathematically inaccessible to us."
1. What "Non-Custodial" Means
In conventional cloud management software, when you enter an SSH private key or root password, it is uploaded to a remote server, stored in a database, and decrypted on the vendor's machine whenever a session starts. This turns the vendor into a custodian of your infrastructure.
Cockpit is non-custodial:
- Your private keys and passwords decrypt strictly inside your local browser runtime via W3C WebCrypto.
- Plaintext credentials never cross our network interfaces or get serialized onto our backend storage.
- When credentials are saved for convenience, they are encrypted with a client-derived master key before leaving your device. We store only ciphertext blobs.
2. Architectural Proof Over Trust
We enforce non-custodial operations through four structural engineering safeguards:
Cryptographic key derivation uses PBKDF2 with 100,000+ iterations executed in browser JavaScript heap memory. The salt and derivation parameters remain local to your browser session.
Our relational databases, Redis caches, and server logs are programmatically barred from ingesting unencrypted key structures. Schemas strictly enforce ciphertext byte arrays.
During active sessions, our proxy acts as a blind TCP/WSS pipeline. Terminal traffic is wrapped in AES-256-GCM / native SSH encryption between your browser and the target server, precluding intermediate packet inspection.
Closing your browser window, logging out, or disconnecting immediately invokes garbage collection and memory overwriting on active key handles. No residual key fragments survive in persistent browser caches.
3. Subpoena & Legal Coercion Immunity
Technology companies frequently receive government subpoenas, National Security Letters, or court orders demanding customer data or decryption keys.
Our non-custodial architecture creates mathematical immunity against decryption orders:
Because Intellaris Private Limited never holds customer decryption keys, it is technically impossible for our staff, infrastructure engineers, or automated systems to decrypt your server sessions or unlock your host machines.
4. Database Breach Resilience
If a threat actor were to achieve complete read access to Cockpit's primary production databases:
- They would obtain only opaque AES-256 encrypted ciphertext blobs.
- Without your unique client-side key derivation secret (which never leaves your local computer), the stolen blobs cannot be decrypted.
- Your remote Linux infrastructure remains safe and unreachable through our servers.
5. Verification & Auditing
We welcome scrutiny of our client-side cryptographic routines. Developers can inspect network traffic in browser developer tools (F12) to verify that raw private keys and passwords are never transmitted across HTTP or WebSocket payloads.
We maintain an active Vulnerability Disclosure & Bug Bounty program to collaborate with independent security researchers and reward findings that challenge our cryptographic safeguards.
Trust built on mathematics
Connect and manage your servers with non-custodial peace of mind.