Zero Server Storage & Local Vault Cryptography

DevsFTP is an entirely local-first workstation application. We do not store, host, process, or retain any of your data, files, credentials, or encryption keys on our servers.

Zero Server-Side Data Storage

DevsFTP operates no cloud relays, proxy gateways, database servers, or remote storage nodes. We have zero access to:

  • Your master passwords, server passwords, or SSH private keys.
  • Your cloud storage OAuth tokens, access tokens, or refresh tokens.
  • Your file contents, filenames, folder directory structures, or transfer logs.

All data remains strictly on your personal computer and travels directly to your chosen server or cloud endpoint.

Offline Vault Specifications

All connection profiles are stored on your local disk. When you set a Master Password, the application implements the following security pipeline offline:

  • Key Derivation: Derived locally using PBKDF2 with 800,000 iterations.
  • Encryption Cipher: Profile configurations, private keys, passwords, and cloud tokens are encrypted using AES-256-GCM.
  • Zero Cloud Trust: There is no password recovery backend. If you lose your Master Password, your profiles cannot be decrypted or recovered.
  • Local Data Locations: Configuration data is stored strictly in your operating system's standard user data directory (%APPDATA%\DevsFTP on Windows, ~/.config/DevsFTP on Linux).

Diagnostic Reports & Bug Submissions

DevsFTP does not upload crash reports or usage logs automatically. Diagnostic data is transmitted only when you initiate an in-app bug submission.

What is shared on submission?

If you voluntarily submit a bug report from within the Diagnostic Console, the payload sent to our receiver endpoint (bugs.php) includes:

  • App Metrics: The client version (e.g. v1.0.1) and target OS platform (win32 x64 or linux x64).
  • Diagnostic Logs: The text content currently visible in your bottom Protocol Log drawer. Please review these logs before sending to ensure you do not include sensitive host info.
  • Anonymization: Client IP addresses are resolved during the request to block malicious posts, but reports are stored without user profile identifiers or session tokens.

Connection Protocols & Network Architecture

DevsFTP operates strictly on a direct peer-to-server architecture. All transfers and terminal sessions occur directly between your workstation and the remote host you specify. DevsFTP operates no intermediary servers, cloud relays, or proxy gateways.

1. SFTP (SSH File Transfer Protocol)

  • Direct SSH-2 Tunneling: Connects directly to port 22 (or your custom port) using the SSH-2 protocol.
  • Authentication Methods: Supports password authentication, OpenSSH/PEM private keys (RSA, ECDSA, Ed25519) with passphrase protection, and SSH Agent integration.
  • Host Verification: SSH host key fingerprints are saved locally in known_hosts.json. If a host signature changes, an alert is raised locally without contacting external verification servers.
  • SSH Port Forwarding / Tunnels: Built-in local, remote, and dynamic SOCKS5 tunneling routes traffic directly through your designated SSH bastion or intermediary server.

2. FTP & FTPS (File Transfer Protocol & FTP over TLS)

  • FTP (Plaintext - RFC 959): Direct connection to FTP servers (port 21). Supports Active (PORT) and Passive (PASV) modes. Notice: Plaintext FTP does not encrypt credentials or data in transit. We recommend SFTP or FTPS for all sensitive transfers.
  • FTPS (TLS Encrypted): Supports both Explicit FTPS (AUTH TLS on port 21) and Implicit FTPS (port 990) using TLS 1.2 and TLS 1.3 encryption.
  • Certificate Validation: FTPS certificates are validated directly against your local operating system's trusted Certificate Authority (CA) root store.

3. WebDAV (Web Distributed Authoring & Versioning)

  • Direct HTTP/HTTPS Communication: Connects directly to WebDAV servers (e.g., Nextcloud, ownCloud, Apache mod_dav, Synology, QNAP NAS).
  • Authentication: HTTP Basic, Digest, and Bearer authentication are transmitted directly over encrypted HTTPS (TLS 1.2/1.3) without proxying.

4. Embedded SSH Terminal

  • Local In-Memory Execution: Interactive terminal sessions run via Xterm.js inside the desktop client and communicate directly over the active SSH shell channel.
  • No Keystroke Tracking: Terminal input, keystrokes, commands, and output buffers exist strictly in local volatile memory and are never transmitted, recorded, or analyzed.

Cloud Storage & API User Data Policy (Dropbox, Google Drive, Microsoft OneDrive)

When you connect DevsFTP to third-party cloud storage providers (including Dropbox, Google Drive, and Microsoft OneDrive), DevsFTP accesses provider APIs strictly to perform the file transfer, browsing, and synchronization tasks you initiate. DevsFTP adheres to each provider's developer terms, API usage guidelines, and limited use requirements as detailed in the references below.

1. What Cloud Data We Access & Why

DevsFTP only requests permissions and accesses information strictly required to provide cloud file management capabilities:

  • Account Identity & Storage Quota: When you authorize your Dropbox (account_info.read), Google Drive, or OneDrive (User.Read) account, DevsFTP retrieves your account display name, email address, and storage quota. This information is displayed only in the client interface to identify the active profile and show available storage capacity.
  • File & Directory Metadata: To display folders and files in the remote browser tree and calculate synchronization differences, DevsFTP reads file names, sizes, directory paths, MIME types, revisions, and modification timestamps (via Dropbox files.metadata.read, Google Drive metadata scopes, and Microsoft Graph Files.ReadWrite).
  • File Contents: DevsFTP reads and writes the binary or text content of files (via Dropbox files.content.read, files.content.write, Google Drive file access, and OneDrive file streams) solely when you explicitly initiate an upload, download, file edit, or synchronization action.

2. Local Storage & Zero Intermediary Relays

  • Direct Client-to-Provider Communication: DevsFTP does not operate any cloud proxies, relays, or middleman servers. All API requests and file payloads travel directly and securely between your personal device and the cloud provider's official HTTPS REST endpoints (api.dropboxapi.com, content.dropboxapi.com, googleapis.com, and graph.microsoft.com) using TLS 1.2/1.3 encryption.
  • Local Token Storage: OAuth access tokens, refresh tokens, and account identifiers are stored solely on your local workstation in DevsFTP's application configuration directory. Tokens are never transmitted to DevsFTP servers or any other party.
  • Master Password Protection: When Master Password protection is enabled, all stored tokens and credentials are encrypted on disk with AES-256-GCM (PBKDF2 with 800,000 iterations).
  • Zero Cloud Retention: DevsFTP servers do not store, log, inspect, cache, or maintain copies of your cloud files, filenames, or tokens.

3. No Sale, Advertising, or AI Training

We strictly adhere to zero-commercialization principles regarding user data:

  • We do not sell, rent, lease, or monetize your cloud data or personal information to third parties.
  • We do not share or transfer cloud files or metadata to advertising networks or data brokers.
  • We do not use your cloud files or account information to train artificial intelligence (AI) or machine learning models.

4. Data Retention, Deletion & Revocation

You maintain complete ownership and control over your cloud connections:

  • Local Data Purging: Deleting a profile in DevsFTP or selecting "Forget Credentials" immediately and permanently removes all associated OAuth tokens, refresh tokens, and profile data from your local computer. Because DevsFTP retains no remote data, no external deletion requests are required.
  • Revoking App Access: You can revoke DevsFTP's authorization at any time directly through your cloud provider's security controls:

Amazon S3 & S3-Compatible Object Storage Policy

DevsFTP provides comprehensive client support for Amazon Simple Storage Service (Amazon S3) as well as S3-compatible cloud and on-premise object storage platforms (including Wasabi, Backblaze B2, MinIO, Cloudflare R2, DigitalOcean Spaces, and Ceph).

1. Credentials Accessed & Handled

To establish a connection to an S3 bucket, DevsFTP accepts the following credentials supplied by the user:

  • Access Key ID & Secret Access Key: Used solely to compute cryptographic request signatures locally.
  • Session Token (Optional): Supports temporary security credentials issued via AWS Security Token Service (AWS STS).
  • Region & Custom Endpoint URL: Designates the target S3 region (e.g. us-east-1) or your private S3-compatible server URL.
  • Target Bucket Name: Restricts operations strictly to the designated bucket namespace.

2. Local Signature Version 4 (SigV4) Cryptography

  • Offline Request Signing: All HTTP requests to Amazon S3 or S3-compatible endpoints are signed entirely offline on your computer using AWS Signature Version 4 (SigV4 HMAC-SHA256). Your Secret Access Key is never transmitted across the network in raw or unhashed form.
  • Direct HTTPS Transport: All API requests (PUT, GET, DELETE, LIST) travel directly over TLS 1.2 / TLS 1.3 between your computer and the S3 endpoint (e.g. https://s3.amazonaws.com or your custom S3 host). No third-party servers or DevsFTP relays intercept your object traffic.
  • Encrypted Local Storage: S3 credentials, bucket settings, and keys are stored locally in profiles.json and protected with AES-256-GCM (PBKDF2 with 800,000 iterations) when Master Password protection is active.
  • Least-Privilege Execution: DevsFTP executes only the standard object operations necessary for user-initiated tasks: s3:ListBucket, s3:GetObject, s3:PutObject, and s3:DeleteObject. DevsFTP never requests or modifies bucket policies, ACLs, IAM roles, or account configurations.

Third-Party Terms of Service & Developer Policies Reference

DevsFTP connects to third-party infrastructure at your direction. When interacting with external cloud storage and hosting services, your use is subject to each respective provider's developer terms, acceptable use policies, and privacy policies:

Zero Telemetry & Analytics

We believe that a developer's file transfer client is private. DevsFTP is completely free of usage analytics and background tracking:

  • No Google Analytics / Telemetry: We do not track what features you click, how long you stay logged in, or what profiles you run.
  • No Update Pings: The client does not download auto-update patches in the background without consent.
  • Verifiable Offline Integrity: DevsFTP is proprietary desktop software engineered to operate strictly on your local hardware. Because zero analytics SDKs or telemetry beacons exist in the software, you can independently verify with any local network packet analyzer (such as Wireshark) that no background telemetry leaves your machine.
  • Tennessee Privacy Standards (TIPA Compliance): DevsFTP aligns with the consumer privacy principles of the Tennessee Information Protection Act. We do not collect, sell, lease, monetize, or disclose your personal identifiers, connection endpoints, or file metadata to any third party.