Server output
termique never records what the server prints, only what people submit.
What is recorded
What was submitted, not every keystroke.
Each entry has a time, the person who ran it and the text. Flags mark the entries that need a second look.
| Entry | When it's recorded | Flag |
|---|---|---|
| Command | A line typed at the prompt and submitted with Enter, as its final text. | — |
| Pasted command | A pasted block, as one entry. | pasted |
| Full-screen tool | Entering and leaving vim, less, top or tmux, and each line typed inside. | tui |
| Control key | Ctrl+C, Ctrl+D and Ctrl+Z, as SIGINT, EOF and SIGTSTP. | — |
| Run by termique | Commands the AI assistant, an investigation or an agent runs on the host. | via app |
| File action | Reads, writes, renames and deletes in the file browser. | file |
| Port forward | A teammate opening a port forward on a shared host. | tunnel |
| Hidden input | A line typed at a password prompt: only its length range and the prompt it answered. | — |
What is never recorded
Output, passwords and the secrets in commands.
Typed passwords
A line typed at a password, passphrase, PIN or one-time-code prompt is stored only as hidden input with a length range and the prompt it answered.
Secrets in commands
Tokens, Authorization headers, --password flags, passwords in URLs and private key blocks become [REDACTED] before the entry leaves your device. It catches common patterns, not every secret.
Before you turn it on
What to know.
Stored in plain text
Your passwords and keys are end-to-end encrypted; command logs are not. They are stored on the termique backend in plain text after scrubbing, so teammates can read them. Turn logging on only where that is acceptable.
Only sessions through termique
It records commands run through termique on the desktop and mobile apps. Someone connecting with another client isn't logged; for that, pair it with server-side auditing such as auditd.
Retention and limits
Entries are deleted after 90 days on every plan, and each host keeps up to 10,000. Offline, up to 200 entries per host wait and upload when you reconnect.
Plan
Command logs are part of Pro. On a Pro owner's host, teammates on Free are logged like everyone else. Logging is off by default, per host.
01What does an SSH audit log record in termique?
Each command submitted at the prompt, with the time, the person who ran it and the host. It also flags pasted blocks, full-screen tools like vim, commands run by termique itself, file actions and port forwards. It never records the output the server prints.
02Are passwords or tokens stored in the log?
Lines typed at a password prompt are stored only as hidden input with a length range. Before an entry leaves your device, likely secrets in commands, such as tokens, Authorization headers and passwords in URLs, are replaced with [REDACTED]. Scrubbing catches common patterns, not every secret.
03Are command logs end-to-end encrypted?
No. Unlike your passwords and keys, command logs are stored on the termique backend in plain text, after scrubbing, so teammates on a shared host can read them. Turn logging on only for hosts where that is acceptable.
04How is this different from auditd or session recording?
auditd logs system calls on the server itself and needs root to set up and read; session recorders capture the full terminal stream, output included. termique records the commands people submit through termique, per host, without installing anything on the server and without the output.
05Which plan includes command logs?
Pro. On a Pro owner's host, teammates on the Free plan are logged like everyone else. Logs are kept for 90 days, up to 10,000 entries per host.