Security isn't a feature. It's the architecture.

Encryption Protocol

Steer uses the Noise Protocol Framework (pattern IK) for key exchange, the same cryptographic foundation used by WireGuard, WhatsApp, and Lightning Network.

After pairing, all messages are encrypted with ChaCha20-Poly1305 — an AEAD cipher that provides both confidentiality and integrity. Keys are rotated every 24 hours or on demand.

Key Storage

On iOS, your identity keypair is stored in the Secure Enclave — a hardware security module that prevents key extraction even if the device is jailbroken. On Android, keys are stored in the Hardware Keystore with setIsStrongBoxBacked(true) on devices that support StrongBox.

What We Can See (and Can't)

server vs device 
╔══════════════════════════════════════════════════════════════╗
║                                                              ║
║  WHAT THE SERVER SEES           WHAT YOUR DEVICES SEE        ║
║  ════════════════════           ═══════════════════════      ║
║                                                              ║
║  - Session ID (UUID)            - Full terminal output       ║
║  - Timestamp of activity        - File diffs with color      ║
║  - Encrypted blob size          - Permission prompt details  ║
║  - Source: mobile/desktop       - Project paths and names    ║
║                                 - Agent type and config      ║
║  That's it.                     - Cost data and tokens       ║
║  No code. No paths.             - Every keystroke you send   ║
║  No prompts. No diffs.                                       ║
║  No file names.                 Decrypted only on your       ║
║                                 devices.                     ║
║                                                              ║
╚══════════════════════════════════════════════════════════════╝

Recovery

If you lose your phone, your 24-word recovery phrase lets you derive your identity keypair on a new device. The phrase is shown once during setup. We don't store it. We can't recover it for you.

Threat Model

Threat Mitigation
Relay server compromised Attacker gets encrypted blobs only. No keys.
Phone stolen (locked) Secure Enclave protects keys. Device PIN required.
Phone stolen (unlocked) Biometric lock on Steer app. Session timeout (5 min).
Man-in-the-middle Noise IK authenticates both parties via static keys.
Replay attack Noise Protocol nonce prevents replay.
Key compromise Rekey mechanism + recovery phrase to rotate identity.

Open Source

The relay server and encryption library are open-source. Audit the code yourself.

View on GitHub →