Security on Miko Cloud

No passwords

You sign in with a passkey: your device plus Face ID, Touch ID or your PIN. It can’t be phished.

Your account key

It’s created on your device and locked with your passkey.

Your machines only talk to devices this key approved.

End-to-end encrypted

Every keystroke, every line of output and every approval is encrypted between your devices and your machines.

Check words

Connecting a server shows the same three words on both screens. Nothing is added until you confirm them.

The code works once, expires after 10 minutes and never shows in the server’s process list.

New devices

A new device joins only with your passkey, your recovery key, or approval from a device you already use.

Approval takes a matching 6-digit number plus your passkey.

A removed device is cut off from every machine within about 2 seconds.

Your AI sign-ins

Each AI sign-in runs in that app’s own login on your machine, and stays there.

A Miko Cloud machine keeps and renews the sign-ins you add to it, and can share them with your other machines when you press Connect. Whoever runs the server that keeps a sign-in can read it.

Private notifications

Contents are encrypted on your machine before they’re sent, so Apple and Google only carry sealed messages.

Hide details on the lock screen leaves out names, commands and questions.

No open ports

Your machine connects out to Miko over HTTPS. Nothing needs to come in.

Updates

Updates wait until no agent is working, and roll back by themselves if something fails.

Agents on your server

Agents run as a separate user that can never log in. Your other home folders are hidden from them.

Connections

Sealed on your device. Miko’s servers store them locked. Only your machines can unlock them.

Account recovery

Email recovery takes 3 days and warns every device and your email first.

Only allow passkeys turns email codes off.

Good to know

Previews are encrypted on the way, but not end to end like your terminals. Agents on one machine share its files. Where Miko can’t check which agent asks for a key, as on Debian 12 by default, any agent on that machine could read it.

Miko Cloud uses AMD SEV-SNP memory encryption, encrypted disks and end-to-end encrypted terminal connections. Cloud machines open only with memory encryption in place. Miko Cloud runs in North America at launch. See the current Security page for the protections, hardware verification and their limits.