> ## Documentation Index
> Fetch the complete documentation index at: https://docs.monolex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> One login, no ssh, and every byte encrypted end to end.

## Is it encrypted? Yes — every byte.

Every vpncli connection is encrypted **end to end between your two machines**.
The coordination server that introduces them never sees your data.

```
┌──────────────────────────────────────────────────────────────────┐
│  WHAT'S ENCRYPTED                                                │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│   your keystrokes        ✓  encrypted, machine ↔ machine         │
│   command output         ✓  encrypted, machine ↔ machine         │
│   files you copy         ✓  encrypted, machine ↔ machine         │
│   the mosh session       ✓  double-encrypted (mosh + vpncli)     │
│   login + discovery      ✓  over HTTPS to the server             │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘
```

The peer-to-peer link uses the same transport encryption (DTLS) that powers
secure WebRTC everywhere. Your terminal data rides that link directly between
the two machines — the server only helped them meet.

## One login, no ssh

Access is controlled by your **Monolex login**, not by ssh keys scattered across
machines.

```
┌───────────────────────────────────────────────────────────────────┐
│   • You must be logged in to connect at all.                      │
│   • You only ever see and reach machines on YOUR account.         │
│   • No ssh account or key is needed on the target machine.        │
│   • Even mosh's session key is delivered over the encrypted       │
│     link — never over a plaintext channel.                        │
└───────────────────────────────────────────────────────────────────┘
```

## Mosh: encrypted twice

`vpncli mosh` layers two independent encryptions, so one never depends on the
other:

```
   your keystrokes
        │  mosh's own encryption   (mosh built-in)
        ▼
        │  vpncli peer-to-peer     (DTLS)
        ▼
   remote shell
```

## The one honest detail

The coordination server has to know **which machines** are connecting in order
to introduce them — so it sees that "your laptop is connecting to your server."
It never sees **what** they exchange. If your threat model requires hiding even
that connection metadata from your own coordination server, that's a different
posture than vpncli optimizes for; for reaching your own machines, your data is
private and the metadata stays within your own account.

## In short

```
┌──────────────────────────────────────────────────────────────────┐
│   Data      → encrypted end to end, machine ↔ machine            │
│   Access    → your Monolex login (no ssh, your machines only)    │
│   The server→ a matchmaker that never sees your data             │
└──────────────────────────────────────────────────────────────────┘
```

## Next

<Card title="How it works" icon="diagram-project" href="/vpncli/how-it-works">
  The matchmaker model, in one diagram.
</Card>