Zero-knowledge vault

Servers and credentials,
in one place

SHTERA centralizes a team’s scattered servers and passwords, all from the browser, with no client to install. What the product rests on isn’t the connection console, but the encrypted vault and the folder tree that decide who reaches each server.

Create account View plans

Protocols: SSH, RDP, VNC, Telnet, SFTP

Recovery code characters

0min

Idle folder-VPN auto-shutdown

Runs on

SSH RDP VNC Telnet SFTP guacd PostgreSQL Docker SSH RDP VNC Telnet SFTP guacd PostgreSQL Docker

Encrypted vault

One key per folder

The user’s password never reaches the server: the browser derives the encryption key right there. Each folder has its own key, so sharing one doesn’t expose the rest.

Root folder

Production

Staging

Tree with inheritance

The most specific rule wins

Folders are dragged and dropped, with credentials and permissions inherited from the folders above. When a folder has its own rule, that’s the one that applies.

Password, once

↓

Key pair generated

↓

authorized_keys installed

No passwords to remember

Saved only if it connects

You enter the password once and, on save, SHTERA checks it can reach the server, signs in, generates a key pair and installs it. If anything fails it tells you what, and nothing is saved half-done. From then on nobody types that password again. RDP, VNC, FTPS, databases and S3 buckets work the same way, always inside the browser.

Change outside a session

↓

Checked every few minutes

↓

Alert before it’s too late

Off-session monitoring

Finds out before it’s too late

A sentinel checks your Linux and Windows servers every few minutes, without opening a session or ever trying a password: if a user shows up that you didn’t create, a password changes, a scheduled task appears out of nowhere, or Windows Defender gets turned off, you get the alert by email and WhatsApp within minutes. The same check shows your server’s live status —processor, memory, disk (the fullest filesystem, not just root), swap, and uptime— so a disk running low on space shows up on the dashboard before it becomes a problem. And while you’re using SHTERA’s console, twelve more rules flag it on the spot if someone changes a password or opens a new account, while the session is still open.

More pieces

What covers the rest of the team

Per-folder or per-server VPN

For servers behind NAT, each folder can spin up its own VPN on demand, on every plan including Free. A single server can also have its own, with a switch to inherit the folder’s or not. It’s loaded by uploading the provider’s file —WireGuard .conf or OpenVPN .ovpn— and the panel shows what it understood before you save. It shuts itself down after 15 minutes of no use.

Control panels, already signed in

CWP, cPanel/WHM, Plesk, DirectAdmin, Hestia, CyberPanel and aaPanel open INSIDE SHTERA, as just another tab, already authenticated as admin or root: nobody types or copies a password to get in. For any other panel, the address stays saved with username and password, one click away from copying.

Auditing and recording

Every session is audited, on any plan. Starting on the Básico plan, sessions are also recorded, with a quota measured in gigabytes.

Files and buckets

The file explorer opens any server over SFTP or FTPS, and an S3 bucket too — AWS or compatible, path or subdomain style — as if it were just another folder.

Live resource monitoring

The same check that watches for security changes also measures the server’s state: processor, memory, disk —the fullest filesystem, not just root—, swap, and uptime, updated every few minutes, with nothing to install.

Routers and firewalls

Mikrotik, Cisco, Juniper, Fortinet and PaloAlto are added like any other server, with their own SSH console in the browser. Automatic pairing, the file explorer and resource monitoring are server-OS features and don’t apply to these devices.

Just shipped

Day one stops being a wall

You used to load servers by hand, one at a time. Now you connect an account and they show up on their own.

Import what you already have

Connect a read-only API key and your servers show up on their own, in your folder tree.

Providers: AWS (EC2), DigitalOcean, Hetzner, Vultr, Linode, Proxmox, VMware (vCenter), and Virtualizor. All eight, working.
No loading servers by hand — not by file, not one at a time.
It syncs, it doesn’t just import once. New servers show up on their own. Ones the provider drops get flagged, never deleted: deleting them would destroy the credentials you already loaded.
Moved a server to a different folder? The sync leaves it right where you put it.

Server credentials don’t come with the import. No cloud provider hands out a machine’s SSH key. They arrive ready for the automatic pairing the rest of SHTERA already uses.

Ansible, from the browser

Run playbooks against every server in a folder, with nothing to install on your machine.

The inventory builds itself, from the folder tree and its inheritance.
Runs in a disposable container that gets deleted when it finishes.
Dry-run by default: see what it would do, before it actually does it.
Host verification on, using the fingerprints SHTERA already saved during pairing. Almost nobody does that.
Everything gets logged: who ran it, against which servers, which playbook, and the result of each one.

Transparency

Decisions, not accidents

A single nameserver: ns1 and ns2 of the same domain, pointing at the same IP.

Redundancy

It gives no high availability, and that’s known.

The Free plan includes one RDP connection, not just SSH.

Bandwidth cost

Weighed and accepted before launching the free plan.

The rescue key lives encrypted on a separate machine, closed to the world, and is only used after a verified charge to the card.

Assisted recovery

For when the other three keys are lost at once.

Infrastructure

Nothing shared with other projects

Dedicated VPS, no control panel. The vault doesn’t share a box with anything else.

Docker

PostgreSQL

guacd

PowerDNS

nginx / Caddy

ufw

FAQ

What people ask before signing up

No. Everything runs in the browser, over guacd. Connections come from the VPS’s IP: a server that filters by IP has to allow it, and ones behind NAT use the folder VPN.

There are two safeguards besides the password: a 24-character recovery code given out when the account is created, and a WebAuthn PRF-compatible passkey. If you lose all three at once, assisted recovery is still there: it requires verifying your identity with a small card charge. More detail on the Security page.

One at a time, by CSV, or by network range. A non-standard port is declared when the server is added — nothing gets scanned.

Event auditing runs on every plan. Full recording in compressed .guac format starts on the Básico plan, with a quota measured in gigabytes.

You’re warned on reaching 80% of the contracted quota. At 100%, recording stops, without cutting off sessions already in progress.

Yes, starting on the Básico plan. A sentinel checks each server every few minutes — over SSH on Linux, over WinRM on Windows — looking for changed passwords, new users, scheduled tasks, or a disabled antivirus, without ever opening a session or trying a password. The alert always arrives by email; starting on the Avanzado plan it also arrives by WhatsApp, within minutes rather than days (1 number on Avanzado, 2 on Pro, 5 on Empresa). The Free and Inicial plans don’t include the sentinel.

Yes. The same sentinel check measures, every few minutes, each server’s processor, memory, disk —the fullest filesystem, not just root—, swap, and uptime, with nothing to install. It shows up live in the dashboard.

Yes, like any other server: Mikrotik, Cisco, Juniper, Fortinet and PaloAlto are added and opened over an SSH console from the browser. Automatic pairing, the file explorer, and resource monitoring don’t apply to these devices — those are server-OS features.

By uploading the file your provider gives you —a WireGuard .conf or an OpenVPN .ovpn—: the panel converts it on its own and shows what it understood before you save. It can belong to a whole folder or to a single server, with a switch for that server to inherit the folder’s VPN or not. Available on every plan, including Free.

Yes, for the seven supported ones (CWP, cPanel/WHM, Plesk, DirectAdmin, Hestia, CyberPanel, and aaPanel): they open in a tab inside SHTERA, already signed in as admin or root. Nobody sees or copies the password to get in. Any other panel is saved with its address, username, and password, one click away from copying.

Servers and credentials,in one place