troubleshooting-faq
FAQ
Straight answers about Kutrion's security model, self-hosting, air-gapped operation, where keys live, supported platforms today, and how AI is kept private.
Updated 3 सित॰ 2026
Short, honest answers to the questions people ask most. For definitions of the terms used here, see Core concepts.
Security model
Is Kutrion zero-knowledge?
No. Kutrion is an audited access broker, not zero-knowledge, and we say so rather than market a guarantee we cannot keep. The server decrypts a secret in memory only for a specific authorized, audited action — revealing a value, injecting a credential into a session, scanning output for a leak — and then discards the plaintext. No plaintext credential material is kept at rest, and every such action lands in a tamper-evident audit trail. A strict zero-knowledge design would rule out the broker features teams actually need, all of which require the plaintext in memory at the moment of use. See Security model.
Self-hosting
Can I self-host it?
Yes. Self-hosted / on-prem mode runs Kutrion on your own infrastructure as a Docker Compose unit, including fully air-gapped. It is the same image and the same features as the hosted service; only the configuration differs. See Self-hosting overview and SaaS vs self-hosted.
Does an air-gapped install phone home?
No. An air-gapped install does not need to reach the internet. Entitlements are verified offline from a signed license file, so there is no activation call. The connected heartbeat is opt-in and off by default — an air-gapped deployment simply leaves it off. See Licensing and activation.
Where do my encryption keys live?
Kutrion uses envelope encryption: each secret is sealed with a per-record data key, and that key is wrapped by a higher master key. Where the master key lives depends on how you configure key management — a local key, your own HashiCorp Vault Transit key (which can itself be HSM-backed), or an AWS KMS customer managed key. The provider is chosen per deployment by whoever operates it, so on a self-hosted install the keys are yours, in your own infrastructure. See Cryptography and HashiCorp Vault sync.
Platforms
What platforms are supported today?
The web app is the full product and needs no install. Alongside it you can download the
Windows and Linux desktop apps, Kutrion Terminal and Kutrion Transfer for Windows and
Linux, the Kutrion API desktop client for Linux, the browser extension for Chrome, Edge and
Firefox, and the CLI (which also carries the MCP bridge, kt mcp). None of them is published to a
store or a public registry: you take the files from Downloads, and because the builds
are unsigned you allow them past your operating system on first launch — each card carries the steps.
macOS, iOS, Android and a Safari extension are not available yet.
Downloads states what this deployment offers right now, so treat it rather than this page as the current list. See Browser extension overview for what the extension does.
AI
How is AI kept private?
AI is privacy-first: it defaults to a self-hosted Ollama model rather than a cloud one, and there is no configuration in which a cloud model is the silent default. That default says which kind of model answers, not whose network it runs on. On a self-hosted Kutrion install the model runs on an endpoint you operate, so terminal output and secrets do not leave your network. On the hosted service the default is the deployment’s own Ollama endpoint — Kutrion’s infrastructure, not yours — until an organization admin points Kutrion at an endpoint you operate.
What keeps terminal output away from a cloud model is that default plus a per-organization opt-in that is off until an admin turns it on — the cloud path additionally needs a configured cloud key and the cloud-AI plan entitlement, and all of them are required together.
When an organization does opt in, be clear about what travels: the commands your members ran, the terminal output around them, and the hostnames and file paths inside that text all reach the cloud model. Recognizable secrets, email addresses and IP addresses are stripped first, and every cloud call is recorded on the audit trail (by default as a hash and length of what was sent; the text only if an admin opts in) — but that step is a secret-and-PII filter, not a transcript filter, and it is not what keeps operational content on your network. Leaving the organization on the self-hosted default is. See AI privacy model and AI overview.