Security

Thinair gives you and your agents as much freedom as it can, and holds a few rules without exception. Each one is decided in one place in Thinair's code and checked on every change.

The eight rules

1. Each account is a wall. Your computer's install, your Thinair Cloud account and each organization share nothing. Your own computers reach your Cloud account as you, and with Thinair Pro they reach each other too.
2. Your computer is yours. What runs straight on your computer, such as a Terminal there, the agent in it and the thinair command, can do anything in that computer's Thinair: every Profile, app and File.
3. A VM never reaches your computer. An app in a VM gets in only through Thinair Files, ports you shared, and the package sources its app declares (npm, for a Component). VMs cannot reach each other. This holds in every mode.
4. An agent owns its Profile. It acts as the Profile it runs in, never as you. There it can do anything. To enter another Profile it asks, and someone who manages that Profile answers. Every action it takes traces back to the messages that started it.
5. Only your own click sets access. Allows, levels, Window grants, folders, remote access and modes change only by a person's own click. Agents can only ask.
6. A Component gets no secrets. Its code runs in a VM with no network card, in no Profile.
7. Organizations share by Profile. Each member has one level on each shared Profile, and a private Profile is its maker's alone.
8. Only Thinair-signed code runs. Every piece of Thinair is checked against its signed record each time it starts, and updates come from a signed feed.

Underneath

• On a Mac, the computer's key lives in the Secure Enclave, and only Thinair's own signed helper can use it.
• Each Profile's secrets are sealed under a key of its own. Removing the Profile removes the key.
• A Cloud app asleep in Cloud's store is encrypted under a key for your account alone.
• The Agent masks a Profile's secrets in everything it keeps or shows.
• Every grant and port share is listed, each with Remove.

Read more on the Security page.