FusionTermHow FusionTerm protects your data
Your data stays with you
FusionTerm runs on your server. Saved servers, passwords, keys, the vault and the audit log are stored there, in the data volume — nowhere else. There's no FusionTerm cloud account and nothing to sign up for.
Encrypted at rest
Saved passwords, private keys, passphrases, vault entries and two-factor secrets are encrypted with AES-256-GCM using a key (secret.key) that's generated on your server the first time FusionTerm starts. Account passwords are stored as one-way hashes (bcrypt).
Encrypted in transit
Put FusionTerm behind HTTPS (see Run it behind HTTPS) and everything between browsers and FusionTerm is encrypted; SSH and RDP are encrypted from FusionTerm to your servers. When you connect, FusionTerm uses the saved credentials itself, on the server — they reach a browser only when someone deliberately reveals a secret in the vault.
Signing in
- Passwords of at least 8 characters, two-factor codes (required for administrators) or single sign-on.
- New accounts never keep a password someone else chose: invite links and account requests let people pick their own, and a temporary password from an admin must be replaced at first sign-in.
- Failed sign-ins block the address, not the account. 3 wrong attempts — wrong password or wrong two-factor code — from one network block that network from signing in to that account for 10 minutes. Trying again while blocked, or failing again within 24 hours, makes it 30 minutes. While blocked, passwords aren't even checked. You, on your own network, can still sign in: a stranger who knows your username can't lock you out.
- Safety nets for attacks from many addresses: 10 wrong two-factor codes in a row lock the account for 30 minutes (only someone who knows the password gets that far — change it if you didn't cause this). Accounts without two-factor also lock for 30 minutes after 20 wrong passwords in an hour; turn on two-factor to avoid that.
- Any single address with too many failed sign-ins across all accounts is slowed down too. Every block is recorded in the audit log, and an administrator can lift it early: Settings → Users → Manage → Unlock sign-in.
- Every sign-in is a device you can see and end (Offboarding); sign-ins expire after 30 days at most.
Connecting to servers
- Every server's SSH key fingerprint is checked, including each jump host — see Host key checks.
- People with Use access to shared connections or vault entries connect without ever seeing the secret.
- Root access in the file manager is opt-in, password-checked and time-limited — see Working as root.
Accountability
Sign-ins, connections, host-key decisions, tunnels, sudo actions and settings changes are written to the audit log. Passwords and keystrokes are never recorded.
What FusionTerm sends out
Nothing about you or your servers. The only outgoing request of its own is the optional daily check for a new version — an anonymous request to Docker Hub, turned off with FUSIONTERM_UPDATE_CHECK=0. License keys are checked offline.