OpsPocket security

Last updated: 10 November 2026

OpsPocket holds SSH keys and runs commands on your servers, so it's built so that you don't have to trust us with them. This page says how, in plain words, for you and for your company's security team. What data goes where is in the privacy policy. A one-page summary to share is at opspocket.app/security-overview.pdf.

The short version

• No account, no cloud. Your servers, keys and passwords stay on your phone. They never reach us.
• Plain SSH, straight from your phone to your server. Nothing is installed on your servers, unless you turn on alerts with the app closed, which adds one small helper you can remove from the app.
• Keys protected by the phone's own secure storage: the Android Keystore or the iPhone Keychain. They are never synced to a cloud.
• No analytics, advertising, tracking or crash-reporting code. An automated test fails the build if any is added.

What we can and can't see

Your server addresses, user names, keys, passwords, commands, files, terminal output and agent chats never reach Mt7. There is no OpsPocket account and no OpsPocket cloud that holds them.

Only three things ever reach a server of ours, and none of them carries your server data:

• The Pro check (Pro users only, a few times a week): the store's proof of purchase, a random ID made for this install, and a proof from Google Play or Apple that this is the genuine app. Our server keeps only what that check needs, such as a scrambled form of the purchase for 30 days (the privacy policy lists it all), and nothing about your servers.
• Reports on AI answers, only when you choose to send one.
• Alerts with the app closed, only in versions that have them and only for servers where you turn them on. Each alert is encrypted on your server with a key made on your phone, and our relay passes it to Apple or Google for your phone without being able to read it.

The Assistant talks to the AI provider you choose, with your own key, and asks before it first sends anything. The agent chat runs the AI CLI that is already signed in on your server, under your account there.

On your phone

• Encrypted vault. SSH keys, saved passwords and other secrets are kept in the iPhone Keychain or encrypted with a key held by the Android Keystore. They're left out of the phone's cloud backups; the only backup is an encrypted file you make yourself.
• App lock. Face ID, a fingerprint or your passcode opens the app, and it locks again after a minute away.
• Keys that expire. You choose how long keys may stay unused: after 7, 30 or 90 days without an unlock, a number of days you pick, or never. After that, the app removes its keys and saved passwords. This phone's key line on your servers gets an end date too, so a key copied off a lost phone stops working on the server.
• Failed unlocks. After 5 wrong tries the app makes you wait, longer each time. After 10, it removes the key it made on this phone from the servers it can reach and erases everything on the phone. You can turn that last step off.
• Screen privacy. Screens with keys or passwords are kept out of screenshots and recordings on Android, and hidden while the screen is recorded or mirrored on iPhone. The app hides itself in the app switcher.
• Quiet notifications. By default an alert says only what kind it is, such as "A server needs attention", so nothing about your servers shows on the lock screen.

On the connection

• Strict host key checking. The app checks every server's key and won't connect if a key changes.
• Modern SSH only. Keys made on the phone are Ed25519, and the app uses only modern SSH algorithms.
• Jump servers stay end to end. A server reached through a jump server is still encrypted all the way between your phone and that server.
• Your own network. It works with your VPN or private network, with a setup guide for Tailscale, NetBird, ZeroTier, WireGuard and others.
• Limit where a key works from. The app can add a from= limit to this phone's key on your servers.

Changes to your servers

• You see the exact command first. Every change the app's buttons make and every command the Assistant suggests is rated by risk and shown in full before it runs. Destructive ones need you to type CONFIRM and use Face ID or a fingerprint.
• AI agent changes wait for you. When an AI coding agent wants to change something, it waits for your approval with your fingerprint or screen lock, unless the agent's own settings on your server already allow it.
• Read-only servers. Mark a server read-only and the app refuses its own changes there: its buttons, file uploads and agent approvals. It only keeps this phone's key line up to date.
• Secret files stay locked. Private keys, .env files and AI sign-in files can't be fetched by Files or sent to the Assistant.
• Signed audit log. Changes are recorded in a log that is hash-chained and signed with Ed25519, so tampering shows.
• Cron backups. The app saves a copy of the crontab before every change it makes.

Every connection, visible

• Network activity. Settings lists every connection the app makes, with where it went and why, kept on the phone for 7 days.
• Strict privacy. One switch stops everything except SSH to your servers, store purchases and the Pro check. If its setting can't be read, it fails closed.

For security and compliance teams

• Nothing about your servers reaches us, so there is no copy of it on our side to assess.
• No agent to approve on your servers. OpsPocket uses your existing SSH accounts, keys and permissions, and your own network.
• Certifications. OpsPocket and Mt7 Private Limited don't hold SOC 2 or ISO 27001 certification today. We'd rather say so than imply otherwise. What we offer instead is the design above, and straight answers to your security questionnaire.
• Who we are. Mt7 Private Limited, a company registered in India (CIN U68200UP2025PTC233604). Write to developer@mt7.in for questionnaires or questions.

Report a vulnerability

If you find a security problem in OpsPocket, opspocket.app or opspocket.mt7.io, email developer@mt7.in with "Security" in the subject. Please include what you found and how to reproduce it, and give us a reasonable time to fix it before telling others. We answer within 2 working days, keep you updated, and credit you in the release notes if you'd like. We treat reports made in good faith as help.

Our contact details for researchers are also at opspocket.app/.well-known/security.txt.

Limits

No app can be perfectly secure. Keep your phone's own screen lock on and its system up to date. If we learn of a problem that puts your data at risk, we'll fix it, say so in the app's release notes, and tell the authorities where the law requires it.