Vault & encryption

The vault is Rumus’s encrypted local store for everything sensitive: SSH host records, private keys, saved username / password pairs, command snippets, and known-host fingerprints. It’s built on Stronghold, an open-source secrets engine, and locked with a secret key that only you ever see. When the vault syncs to the cloud, it does so as ciphertext only — Rumus servers cannot read your secrets. The vault is tied to your Rumus account. You have to be signed in to set it up, and signing out on a device wipes the local copy on that device (the cloud copy is preserved).

​

What’s in the vault

The vault is split into a handful of typed stores, each visible as a tab in Settings → Vaults: Everything in any of these tabs is encrypted at rest with your secret key.

​

Set up the vault

The vault initializes the first time you do something that needs it — usually when you click Remote Connection to add your first host.

​

How the secret key and PIN work together

• The secret key is the actual encryption key. It’s needed for the very first setup on a device, and any time you want to recover or migrate.
• The PIN is a fast-unlock code derived from the secret key. Once set up, you only need the PIN to unlock the vault on this device session-to-session.

Lose the PIN? Re-enter the secret key to set a new PIN. Lose the secret key without a backup? You’re locked out of the encrypted data.

​

Unlocking and locking

The vault unlocks automatically the first time you need it in a session (e.g. opening a remote tab) — Rumus prompts for your PIN if it isn’t already unlocked. It stays unlocked until you quit the app. To force a re-lock, quit and reopen Rumus. (A dedicated “Lock vault” button isn’t surfaced today.)

​

Failed PIN attempts

Repeated wrong PINs are rate-limited. After several failed attempts in a row, you’re forced to wait before trying again. This isn’t optional and isn’t configurable — it’s part of the threat model: a casual attacker shouldn’t be able to brute-force a 6-digit PIN.

​

Backing up the secret key

The single most important thing to do after setup. If your hard drive dies, your laptop is stolen, or you reinstall the OS:

• With a backup — install Rumus on a new device, choose Recover existing key, paste or upload the backup, and the vault is yours again.
• Without a backup — the encrypted data in the cloud is unreadable. You’d start over.

Recommended places to keep the backup:

• A password manager (1Password, Bitwarden, etc.) — the secret-key file is small enough to attach.
• A second physical location — printed and sealed in an envelope, or a USB stick in a drawer.

​

Reset the vault

If you decide to start over — lost secret key, fresh start, handing off the device — use Settings → Account → Reset Vault. The reset is email-confirmed and wipes both the local vault and the synced cloud copy. See Reset vault for the full flow. Reset is destructive and not undoable. Make sure that’s what you actually want.

​

Privacy

• Everything in the vault is encrypted on your device before it ever touches Rumus’s servers.
• The secret key never leaves your device — Rumus has no copy and cannot help you recover one you’ve lost.
• The PIN doesn’t leave your device either — it’s used to derive a local unlock token, not transmitted.

​

Next steps