Help › Security
How bananana.dev keeps things safe
End-to-end encryption, a relay that can't read anything, keys that never leave their computers, permissions checked twice, a tamper-evident audit log, and nightly backups. In plain words, with the technical names for your IT.
bananana.dev can open terminals and screens on your company's computers, so it's built on the assumption that something, somewhere, will one day go wrong, and limits what that could cost you.
Your data stays with you
Everything (accounts, device records, the audit log, settings, history) lives on your brain, on your premises. There's no cloud copy. We (CTF Designs) can't see your devices, your files or your dashboard.
End-to-end encryption
Every message between the brain and a computer is encrypted on one end and only decrypted on the other. The relay in the middle passes sealed envelopes along: it knows which connection gets which envelope, and how big each one is, and nothing else. Not the commands, not the output, not your files, not your screen.
For your IT
Noise protocol Noise_IK_25519_ChaChaPoly_SHA256, the same family of design WireGuard and WhatsApp use. Each computer has its own X25519 key pair made on that computer; the brain pins each computer's public key at enrollment, and each computer pins the brain's. Every connection uses fresh ephemeral keys, so recording traffic today doesn't help decrypt it later (forward secrecy). The relay is a Cloudflare Worker with a Durable Object per brain, and it only ever handles ciphertext.
Your brain's address
A brain set up from bananana.dev gets an address like name.bananana.dev, so you can open it from anywhere without a VPN. Your browser talks HTTPS to bananana.dev, and the relay passes each page on to your brain over the brain's own encrypted connection. That part is encrypted in transit but not end to end: the relay handles the pages your browser loads (it doesn't keep or read them), much like a reverse proxy or a Cloudflare tunnel. What your computers send the brain is still end-to-end encrypted, as above. Sign-in, the authenticator code and every permission check still happen on your brain.
Nothing open on your network
The brain and every computer connect out to the relay over normal HTTPS. There are no ports to forward, no VPN to maintain, and nothing for a scanner on the internet to find.
Joining is protected
- Install commands and deployment keys contain a fingerprint of your brain's key, so the installer refuses a different brain.
- Onboarding codes are filed at the relay under a scrambled form of the code, sealed with a key made from the code, so the relay doesn't hold anything usable. Codes expire after 10 minutes and work once, guessing is limited to 30 tries an hour per network, and the installer shows your brain's name and a check value before installing.
- Computers that join with a code or key wait for approval and get nothing beyond status until approved.
Permissions, checked twice
Every action is checked against two things that both have to say yes:
- The person: their role's permissions and the devices in their scope, checked by the brain for every page, every request and every AI tool.
- The computer: the features it allows (terminal, files, services, screen), enforced by the agent on the computer itself, so even a compromised brain can't turn on what a computer didn't allow.
Powerful actions (terminal, screen control, changing users, Defender exclusions) also ask you to confirm it's you if you haven't in the last 15 minutes.
People can see when they're being viewed
Whenever someone has a computer's screen or terminal open, its bananana.dev icon changes and says who. Remote control is never silent.
A tamper-evident audit log
Every sign-in, every opened terminal or screen, every file change, every install, approval, role change and setting is written to the audit log with who, what, which device, when, and from which address. Each entry includes a fingerprint of the one before it, so if anyone edits or deletes an entry, the chain breaks and Check the chain on the Audit page shows where: The audit log.
Signing in
Passwords plus an emailed code or an authenticator app, or Google and Apple sign-in. Passwords are checked against known breached passwords and stored with a slow, salted hash; repeated wrong attempts lock that address out for 15 minutes. Sessions end after 24 hours idle or 7 days. More: Signing in and your account.
The AI never sees secrets
The assistant is read-only, limited to what you may see, and password files, keys, .env files and anything that looks like a credential are refused or blanked out before anything reaches the AI provider: The AI assistant.
Backups
The brain backs up its whole data folder every night, keeping consistent copies of its databases, and raises an alert if a backup is missing for more than 36 hours. Code and data are also backed up before every update.
Updates are verified
The agent only installs updates whose checksum matches the published list, downloaded over HTTPS from bananana.dev.