How Sternway keeps your data safe

An SSH client that loses your saved hosts and keys costs you hours. Sternway is built so that your data does not disappear: not when you sign out, not when a sync goes wrong, not when an update arrives. This page says what exactly is promised, how it is done, and what is not promised.

The promise

1. Signing out, an account change, a removed device or a failed sync never deletes your own data from the device. After you log out the app keeps working without an account, with every host, group, identity, key, snippet, known host, port forward and setting it had.
2. Before anything that could take data away, Sternway writes a snapshot of the whole vault to the device. An update, a sync, an import that replaces, a restore, an account reset, turning session logs off: each takes a snapshot first, which you can restore from Settings › Backups.
3. A sync never removes a large part of what you have without asking. It holds the removals, takes a snapshot and asks; “Keep my local data” is the default answer.
4. You can always take your data with you. Any snapshot exports as an encrypted backup file that opens on any device with its password, and both apps restore from such a file.

Snapshots

A snapshot is the whole vault: every vault of the profile with all of its items, private keys and saved passwords included, plus history and session log entries (not the recorded sessions themselves).

It is one file in the profile’s snapshots folder, sealed with the profile’s device data key, with a header in the clear that holds only ids, times, the reason and item counts: no name, address, user name or secret. It is written to a temporary file, flushed to disk and renamed into place, then read back and checked before it counts. A write cut short leaves the earlier snapshots untouched.

Reason shown	When
Before update to version	A new version of the app opens the profile for the first time.
Before sync	Once per run of the app, before the first change from the server is applied.
Before a sync that would remove items	A sync would remove more than the threshold below.
Daily	At most once a day, a minute after a change.
Before logging out	Logging out, and deleting the account.
Before an import	An import that replaces hosts, and restoring a backup file.
Before a restore	Restoring a snapshot, so that the restore can be undone.
Before account reset	Resetting the account.
Before session logs were turned off	Turning session logs off for a vault.
Backed up by you	Back up now.

Where a snapshot is needed and cannot be written (a full disk), the action that needed it does not run: no snapshot, no import, no reset.

Kept: every snapshot you took yourself, the newest 10 automatic ones, the newest of each of the last 7 days, and the newest 3 taken before an update. Past 200 MB in all, the oldest automatic ones go first.

The sync safety net

A sync pull settles what it would remove at the end. A known host the server says was deleted is always held and asked about. Otherwise, more than 20 items, or 5 or more of one kind when that is more than half of what the device has of it, are held: nothing is removed, a snapshot is written, and Sternway asks. Until you answer, later syncs remove nothing. Keep my local data sends the held items back to the server, so your other devices get them again.

A sync also never goes back in time: an item version older than the one the device holds is refused and reported, not applied. Folder sync goes through the same code. See How sync and conflicts work.

What is not promised

• A snapshot is on this device only. If the device is lost, wiped or its app data cleared, and you have neither sync nor an exported backup file, the data goes with it. On Android, the app’s data is deliberately kept out of Google’s backups and device-to-device transfers, because it holds private keys.
• A snapshot opens only with this profile’s key, which the system keychain holds. If that key is lost (the keychain was reset), the snapshots cannot be read; an exported backup file does not depend on it.
• Copies of team vaults leave the device when access to them ends: when you are removed, leave, the team is deleted, or the device is revoked. That access was the team’s to end. A team owner who deletes a team is offered an encrypted export of its vaults first.
• Something you delete yourself is deleted. It is in the newest earlier snapshot, and with sync on the deletion reaches your other devices.
• Small sync removals are applied without asking. The “Before sync” and daily snapshots hold what was there.
• It is not a defence against someone with your unlocked device or profile folder, who can delete the snapshots too.

How to use all of this: Back up and restore and Move to a new device.