Privacy Policy
Passerelle — SSH, SFTP and Telnet client for Mac and iPad
In short. Passerelle works entirely without an account. In that case, no data reaches us at all.
If you turn on syncing, your hosts, passwords and private keys are encrypted on your device before they are sent, with a key derived from a passphrase we never see. We host data we are technically unable to read.
No advertising, no tracking, no analytics, no transfer to third parties.
Without a sync account
By default, Passerelle does not talk to any server of ours. Your host list stays on your device, and your passwords in the system Keychain. The connections you open go straight from your device to your servers: we see none of it — not the addresses, not the contents.
With a sync account
Syncing is optional. If you turn it on, here is exactly what our server keeps:
| Data | Why |
|---|---|
| Anonymous Apple identifier | To attach your data to your account. It is a string specific to Passerelle and cannot identify you anywhere else. |
| Email address | Only if you choose to share it when signing in with Apple; Apple's private relay address is accepted. It is used solely to show you which account you are on. We do not email you. |
| Your data, encrypted | Hosts, groups, snippets, commands, passwords and private keys — as encrypted blocks we cannot read. |
| Proof of purchase | A transaction identifier provided by Apple, to check that syncing is used by someone who bought the app. |
End-to-end encryption
Before any data leaves your device, it is encrypted with AES-256-GCM using a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations). That passphrase never leaves your device and is never sent to us in any form.
In practice, our server holds nothing but blocks of bytes, their modification date and their type (“host”, “snippet”…). It cannot know which machines you connect to, under which name, or with which password.
There is a trade-off you should know about: if you lose your passphrase, we cannot reset it or recover your synced data. Nobody can. Keep it in a password manager.
Where the data is hosted
On a server located in Montréal, Québec, Canada (OVH), in a separate database reachable only by the application. Traffic between the app and the server is protected by TLS.
Technical logs
Like any web server, ours records incoming requests: IP address, date, path and response code. These logs serve diagnostics and abuse detection. They are deleted automatically after 30 days and are never cross-referenced with anything.
What we do not do
- No advertising, no trackers, no advertising identifier.
- No audience measurement or behavioural analytics.
- No sale, rental or transfer of data to third parties.
- No profiling, no automated decision-making.
- No collection of your location, contacts, photos or files.
Retention and deletion
Your encrypted data is kept as long as your account exists. You can delete it at any time from the app: Settings ▸ Sync ▸ Delete account. Deletion immediately erases your data from our server and is permanent. The host list on your device is untouched.
Your rights
Under Québec's Law 25 and the General Data Protection Regulation (GDPR), you may request access to your data, its correction or its erasure. Note that we can only return your synced data in encrypted form: we have no means of decrypting it.
Children
Passerelle is a server administration tool intended for a professional audience. It is not directed at children and knowingly collects no data about them.
Changes
Any change to this policy will be published on this page, with an updated date.
Contact us
For any question about this policy or your data: support@gpxcanada.ca.