> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tamery.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Tamery encrypts connection strings and how the two sync modes handle your password.

Every connection string is encrypted before it leaves your device. The sync type controls whether your password is stored in the cloud at all.

## Encryption at rest

All connection strings are encrypted with a **per-user secret key**, unique to your account. Without that key, stored strings are unreadable. Encryption is automatic — nothing to configure.

## Encryption in transit

When your device fetches a connection string, it's decrypted server-side and sent over HTTPS (TLS). The plaintext exists only briefly in server memory during the request; it's never persisted unencrypted, and the per-user secret is held in Infisical, accessible only to the Tamery backend.

To keep the server from ever handling your plaintext password, use **Cloud (without password)** — then only metadata is stored and returned.

## Cloud (with password) vs Cloud (without password)

Both modes sync the connection across your devices.

<Tabs>
  <Tab title="Cloud (with password)">
    Stores the full connection string, including the password, encrypted with your per-user key.

    * Synced to every device you sign in on.
    * No password re-entry when switching devices.
    * Decrypted server-side and sent over HTTPS on sync.

    Best for dev and staging.
  </Tab>

  <Tab title="Cloud (without password)">
    Stores only metadata (host, port, database, username). The password is **never** uploaded.

    * You enter the password the first time you use the connection.
    * It's kept on that device only, encrypted with your per-user key.
    * Clear it anytime via the connection menu (**⋯ → Clear password**).
    * A compromised account exposes no stored password.

    Best for production or strict-policy environments.
  </Tab>
</Tabs>

## Choosing a mode

| Situation                      | Mode                     |
| ------------------------------ | ------------------------ |
| Local / dev databases          | Cloud (with password)    |
| Staging                        | Cloud (with password)    |
| Production                     | Cloud (without password) |
| External secret-storage policy | Cloud (without password) |
| Shared machines                | Cloud (without password) |

You can mix modes per connection.

## Open source

Tamery is open source under **AGPL-3.0**, so the encryption implementation is auditable: [github.com/wannabespace/tamery](https://github.com/wannabespace/tamery). Report security issues via the repository.

<Warning>
  Never share connection strings — they contain everything needed to access your database. If one
  leaks, rotate the password and update the connection.
</Warning>

<Note>
  Query traffic goes directly between your machine and your database. Tamery's cloud stores only
  encrypted connection metadata — it never handles live query data.
</Note>