Security and credential model
Know what is local, encrypted at rest, server-readable or end-to-end protected.
Local protection
Local VORTΞXHQ data uses AES-256-GCM encryption with key material protected by the operating system keychain where supported.
Usable credentials
Credentials needed by a server-side protocol must be readable by the component performing that protocol. Cloud SMTP credentials and server-processed API cluster data are encrypted at rest and permission-controlled, but are not end-to-end encrypted. An authorized user may be allowed to reveal a credential.
Vault and sharing
Vault items reduce secret duplication and allow controlled reuse across SSH, SFTP and database workflows. Access checks must happen on every list, use, reveal, update and delete operation.
Your responsibility
Use least privilege, rotate exposed secrets, verify host fingerprints and review imported scripts or SQL before execution. Never place production credentials in screenshots, docs or task descriptions.