How we work
A connection manager is trusted with the keys to everything else. That single fact decides most of what follows — what we encrypt, what we refuse to send, what we sign, and which of the harder options we take anyway.
ZERO-KNOWLEDGE
A master password is used on your device and never sent anywhere. What we hold is sealed with AES-256, and the seal is made and broken only where you are. We cannot read your connections, we cannot reset your master password, and we cannot hand either to anybody who asks us for them — which is the point, and also the reason to write the password down somewhere safe.
BUILT, NOT BORROWED
The remote desktop inside the application is our own work rather than something licensed and wrapped. That costs us time we would rather have spent elsewhere, and it buys the only thing that matters when a session breaks on your machine on a Tuesday: we can go and fix it, in days, instead of filing a report with somebody who has other priorities.
SIGNED, EVERY PLATFORM
Every download is signed by us and verified by the system it lands on — notarised for macOS, published through repositories we sign ourselves for Linux, and through the store’s own signing on Android. The checksum of each file is published beside it, so you can confirm that what you downloaded is what we built.
FOUR LANGUAGES, NO EXCEPTIONS
The application speaks English, Russian, Ukrainian and Georgian. A new piece of user-facing text lands in all four in the same change, because the alternative — a backlog of untranslated strings, shown to whoever happens to be reading — is how a product quietly becomes English-only. We hold this page to the same standard by keeping it in one language rather than four bad ones.
RULES THAT FAIL THE BUILD
Every rule that has been broken twice is now a check that fails the build rather than a paragraph somebody was expected to remember. The one we are proudest of refuses to delete anything you asked us to move until every last file has demonstrably arrived at the other end.
Delivery
Every version below is built, signed, and then installed from the published channel on a machine that runs that system — because a package that builds is not yet a package that installs.
| System | Comes as | Vouched for by |
|---|---|---|
| Windows | Installer — 64-bit, 32-bit and ARM | Checksum published beside every file |
| macOS | Disk image — Apple Silicon and Intel | Signed and notarised by Apple |
| Debian, Ubuntu | Package and repository | Repository signed by us |
| RHEL, Fedora | Package and repository | Repository signed by us |
| Arch | Package and repository | Repository signed by us |
| Android | Google Play, or a direct download | Signed through Google Play |
| iOS, iPadOS | TestFlight, ahead of the App Store | Signed and distributed by Apple |
Software that runs on the machine it was built on is not finished. So every release is installed from the published channel on machines we did not build it on — seven different systems, several of them deliberately old — and the feature that most often breaks between them is exercised by hand before anything reaches the download page. A release that installs cleanly on one system and refuses on another is not a release that went out.
The same instinct decides the rest. We ship what the software needs with it, rather than hoping your system already has the right version of something. Release notes are written for the person who has to decide whether to upgrade. And a version number moves only when every platform behind it actually has that version to download.
Every rule that has been broken twice is now a check that fails the build. Some of them are dull and necessary. One of them is neither: before the application will delete anything you asked it to move, it has to be able to show that every last file arrived at the other end, that none was skipped, and that it is talking to the same server it started with. That check is written twice over, once for each half of the application, and the two copies are kept identical on purpose.