Zero-knowledge vault

Servers and credentials,
in one place

SHTERA centralizes a team’s scattered servers and passwords, all from the browser, with no client to install. What the product rests on isn’t the connection console, but the encrypted vault and the folder tree that decide who reaches each server.

Create account View plans

Protocols: SSH, RDP, VNC, Telnet, SFTP

Recovery code characters

0min

Idle folder-VPN auto-shutdown

Runs on

SSH RDP VNC Telnet SFTP guacd PostgreSQL Docker SSH RDP VNC Telnet SFTP guacd PostgreSQL Docker

Encrypted vault

One key per folder

The user’s password never reaches the server: the browser derives the encryption key right there. Each folder has its own key, so sharing one doesn’t expose the rest.

Root folder

Production

Staging

Tree with inheritance

The most specific rule wins

Folders are dragged and dropped, with credentials and permissions inherited from the folders above. When a folder has its own rule, that’s the one that applies.

Password, once

↓

Key pair generated

↓

authorized_keys installed

No passwords to remember

Sign in just once

For an SSH server, entering the password once is enough: the system generates a key pair, installs the public key on the server, and verifies it. From then on it’s not needed again. RDP, VNC, Telnet, and SFTP work the same way, always inside the browser.

More pieces

What covers the rest of the team

Folder-based VPN

For servers behind NAT, each folder can spin up its own VPN on demand, starting on the Inicial plan. It shuts itself down after 15 minutes of no use.

Auditing and recording

Every session is audited, on any plan. Starting on the Básico plan, sessions are also recorded, with a quota measured in gigabytes.

Just shipped

Day one stops being a wall

You used to load servers by hand, one at a time. Now you connect an account and they show up on their own.

Import what you already have

Connect a read-only API key and your servers show up on their own, in your folder tree.

Providers: AWS (EC2), DigitalOcean, Hetzner, Vultr, Linode, Proxmox, VMware (vCenter), and Virtualizor. All eight, working.
No loading servers by hand — not by file, not one at a time.
It syncs, it doesn’t just import once. New servers show up on their own. Ones the provider drops get flagged, never deleted: deleting them would destroy the credentials you already loaded.
Moved a server to a different folder? The sync leaves it right where you put it.

Server credentials don’t come with the import. No cloud provider hands out a machine’s SSH key. They arrive ready for the automatic pairing the rest of SHTERA already uses.

Ansible, from the browser

Run playbooks against every server in a folder, with nothing to install on your machine.

The inventory builds itself, from the folder tree and its inheritance.
Runs in a disposable container that gets deleted when it finishes.
Dry-run by default: see what it would do, before it actually does it.
Host verification on, using the fingerprints SHTERA already saved during pairing. Almost nobody does that.
Everything gets logged: who ran it, against which servers, which playbook, and the result of each one.

Transparency

Decisions, not accidents

A single nameserver: ns1 and ns2 of the same domain, pointing at the same IP.

Redundancy

It gives no high availability, and that’s known.

The Free plan includes one RDP connection, not just SSH.

Bandwidth cost

Weighed and accepted before launching the free plan.

The rescue key lives encrypted on a separate machine, closed to the world, and is only used after a verified charge to the card.

Assisted recovery

For when the other three keys are lost at once.

Infrastructure

Nothing shared with other projects

Dedicated VPS, no control panel. The vault doesn’t share a box with anything else.

Docker

PostgreSQL

guacd

PowerDNS

nginx / Caddy

ufw

FAQ

What people ask before signing up

No. Everything runs in the browser, over guacd. Connections come from the VPS’s IP: a server that filters by IP has to allow it, and ones behind NAT use the folder VPN.

There are two safeguards besides the password: a 24-character recovery code given out when the account is created, and a WebAuthn PRF-compatible passkey. If you lose all three at once, assisted recovery is still there: it requires verifying your identity with a small card charge. More detail on the Security page.

One at a time, by CSV, or by network range. A non-standard port is declared when the server is added — nothing gets scanned.

Event auditing runs on every plan. Full recording in compressed .guac format starts on the Básico plan, with a quota measured in gigabytes.

You’re warned on reaching 80% of the contracted quota. At 100%, recording stops, without cutting off sessions already in progress.

Servers and credentials,in one place