Legal / 01

Privacy Policy

Last updated 7 September 2026

This policy explains what personal data the EtherSSH service collects, why we collect it, how long we keep it and what rights you have. It applies to the website and application at ssh.etherneco.com.

01Who we are

ETHERNECO LTD ("we", "us") is the data controller for personal data processed through EtherSSH.

Company: ETHERNECO LTD
Company number: 14648043 (registered in England and Wales)
Registered office: The Accountancy Partnership
70 Grange Road East
Wirral, CH41 5FE
United Kingdom
Contact: [email protected]

If you run EtherSSH on your own infrastructure ("self-hosted"), the organisation operating that installation is the controller for the data inside it, and this policy describes the software's behaviour rather than our processing.

02What we collect

Account data

Your email address and, where you set one, your display name.
A password hash — we never store your password itself.
Two-factor authentication settings: authenticator secrets, recovery codes and, if you use email codes, the codes sent to your address.
The invitation record that allowed your account to be created, and the role assigned to it.
If you sign in with EtherLogin (single sign-on), the identifier and email address returned by that identity provider.

Workspace data you enter

Server records: name, hostname or IP address, port, login user, description, tags, category, cloud provider and classification data.
Credentials you choose to store — SSH private keys, passwords and vault secrets. These are encrypted at rest using the application's data-protection key ring and are never written to logs or audit records.
Cloud account configuration, plugin settings, saved commands and notes.

Activity and technical data

An append-only audit log: timestamp, user id and name, action, target, a redacted detail string, the source IP address and whether the action succeeded. It never contains secrets.
Server logs produced by the application and the hosting stack, including IP address, user agent, requested URL and error diagnostics.
Content you pass to a feature that acts on a machine for you — commands you run, files you transfer and log output you ask the application to read.

We do not use advertising or analytics trackers. There is no analytics suite, no advertising pixel and no cross-site profiling anywhere in EtherSSH. See the Cookie Policy for the full list of cookies actually set.

03Why we use it, and on what legal basis

To provide the service — creating your account, connecting to the machines you configure, storing your workspace. Legal basis: performance of a contract.
To keep the service secure — authentication, two-factor verification, rate limiting, the audit log and abuse investigation. Legal basis: legitimate interests (protecting the service and its users) and, for the audit trail, our legal obligations.
To communicate with you — sign-in codes, security notifications and service messages. Legal basis: performance of a contract and legitimate interests.
To improve and troubleshoot — diagnosing faults from error logs. Legal basis: legitimate interests.

We do not sell personal data, and we do not use your workspace content for advertising or to train models of our own.

04Who we share it with

We share data only with the providers needed to run the service, each acting on our instructions:

Hosting and network protection — the servers running the application and Cloudflare, which sits in front of the service to provide TLS, caching and bot protection.
Email delivery — the SMTP provider configured for two-factor codes and security notifications.
Identity provider — EtherLogin, where you choose single sign-on.
AI providers you configure — EtherSSH can send a command, a question or the log excerpt you selected to an AI provider to produce a suggestion. Which provider that is depends on your own configuration: a local model processes the request on your own infrastructure, while a hosted provider receives that content and processes it under its own terms. Nothing is sent until you use an AI feature.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

05International transfers

Our providers may process data outside the United Kingdom. Where they do, the transfer is covered by an adequacy decision or by standard contractual clauses together with the UK International Data Transfer Addendum.

06How long we keep it

Account and workspace data — for as long as your account exists. Delete a server, key or secret and it is removed from the active database.
Audit records — retained after the related object is deleted, so the security trail stays intact; typically up to 24 months.
Technical logs — normally rotated within 90 days.
Backups — deleted data disappears from backups as they age out of rotation.

07How we protect it

All traffic is served over HTTPS.
Stored credentials, SSH keys and vault secrets are encrypted at rest with an isolated data-protection key ring.
Registration is invite-only and two-factor authentication is available on every account.
Sessions expire, sign-in attempts are rate limited, and privileged actions are recorded in the audit log.

No system is perfectly secure. You are responsible for the strength of your own password, for keeping your second factor safe, and for the access rights of the credentials you store.

08Your rights

Under the UK GDPR you can ask us to:

give you a copy of your personal data, or provide it in a portable format;
correct data that is inaccurate or incomplete;
delete your data, or restrict how we use it;
object to processing carried out on the basis of our legitimate interests;
withdraw consent, where processing is based on consent.

Write to [email protected] and we will respond within one month. If you are not satisfied, you can complain to the UK Information Commissioner's Office at ico.org.uk.

09Children

EtherSSH is a professional infrastructure tool and is not intended for anyone under 16. We do not knowingly collect data from children.

10Changes

We may update this policy as the service develops. The date at the top of this page always shows the current version, and material changes will be announced in the application before they take effect.

Questions about this document? Write to [email protected].