> For the complete documentation index, see [llms.txt](https://docs.seawise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.seawise.io/security.md).

# Security & Privacy

## How traffic flows

The client on your server makes an outbound, encrypted connection to Seawise.io, the same direction as browsing the web. When someone opens one of your apps, the request travels through Seawise.io and down that existing connection to your server.

```
Your server  ──outbound tunnel──>  Seawise.io  <──HTTPS──  Visitor
 (client)                          (relay)
```

* Nothing connects **into** your network. No ports are opened on your router.
* Seawise.io can't reach anything on your network that you haven't added in the client.
* The client is the only authority on what gets published. Apps can't be added or pointed somewhere else from the website or the API.

## Encryption

* The tunnel between the client and Seawise.io uses TLS.
* Every app, portal, and custom domain is served over HTTPS with certificates managed for you.

## Access control

* **Private by default.** A new app can only be opened by you.
* **Sign-in on every app.** Opening a private app requires signing in, and access is checked on our servers for every app, not just hidden in the interface. Opening an app uses a one-time code that expires in 30 seconds.
* **Per-person access.** Portals are shared with individual email addresses. Remove someone and their access ends within 30 seconds.
* **Public is opt-in.** Apps and portals only become public when you choose to, after a warning.

## Accounts

* **No passwords.** Sign in with Google, GitHub, or an emailed sign-in link.
* **Device approval.** Connecting a client opens an approval page in your signed-in browser. Requests expire after 10 minutes.
* **Hashed credentials.** Tunnel tokens and session tokens are stored as SHA-256 hashes, not in plain text.

## The client

* **Protected web UI.** Password stored as a bcrypt hash, with a growing delay after wrong attempts. The first-run setup screen closes 5 minutes after start.
* **Runs as non-root** inside the container.
* **Blocks risky targets.** Link-local and cloud metadata addresses (such as `169.254.169.254`) can't be published.
* **Open source.** [github.com/seawise-io/seawise-client](https://github.com/seawise-io/seawise-client).
* **Verified tunnel.** Tunnels use the official [FRP](https://github.com/fatedier/frp) client, bundled with checksum verification.
* **Signed releases.** Images are signed with cosign and ship with an SBOM. Releases are scanned for known vulnerabilities before publishing.

## What we store

| Data                                                                     | Why                                    |
| ------------------------------------------------------------------------ | -------------------------------------- |
| Email address and sign-in provider                                       | Your account and sign-in               |
| Server names, app names, hosts and ports, portals, people you share with | To route traffic and enforce access    |
| Bandwidth usage per app and per person                                   | Plans, billing, and analytics          |
| Sign-in and access records, including IP addresses                       | Security, abuse prevention, audit logs |
| Subscription status (via Paddle)                                         | Billing                                |

We don't store passwords or card numbers, and we don't record or store the content of your traffic. The full details, including who we share data with and how long we keep it, are in the [Privacy Policy](/legal/privacy-policy.md).

## What people you share with can see

The portal's name, description, and logo, and the apps on it (name, icon, address, and online status). They can't see your servers, hosts, ports, other portals, or the other people on the portal.

## Your data

* **Export:** email <support@seawise.io> from your account email.
* **Delete:** **Account Settings → Danger Zone → Delete Account**. See [Account Settings](/account/settings.md).

## Reporting a vulnerability

Email <support@seawise.io> with details. Please give us a chance to fix the issue before disclosing it publicly.