Mobile app (iOS)

The Kutrion mobile app is built with React Native and shares its API client with the web app, the desktop apps, the CLI and the browser extension. It works against the same server and the same audit trail.

Availability

The iOS app is not yet listed on Downloads, which shows iOS as “Coming soon”, and it is not on the App Store. Everything below describes what the app does in the build in the repository; treat Downloads as the current statement of what you can install. The FAQ’s note that iOS is not available yet still applies.

Set up

1. Install the app when it is available to you.
2. On the sign-in screen, enter your email and password. If the account uses two-factor authentication you complete it there. A self-hosted deployment can allow entering a different server address.
3. On first sign-in the app registers the phone as a device and creates a device key. After that, reopening the app unlocks with Face ID or Touch ID, with no password, by signing a one-time challenge from the server.
4. Turn on AutoFill under Settings, AutoFill, which opens the iOS settings where you choose Kutrion as the provider.

Main tasks

Browse the vault and reveal a credential

Vaults and credentials list without any secret in the list response. Revealing a credential is a separate request for that one credential; the server records the read and stamps its last-accessed time.

Fill with AutoFill

Kutrion offers matching saved logins in apps and sites and offers to save a new one when none matches. To make a fill work without a network round trip, the app keeps a sealed copy of the vault on the phone. It is sealed under a device key, which is itself wrapped by a key the server issues. That server-issued key sits in the iOS Keychain behind Face ID or Touch ID, or behind the device passcode where no biometric is enrolled. Revoking the key, signing out, or letting its lifetime lapse wipes the cache. This is the narrow claim: no plaintext credential material on the device at rest. Kutrion is an audited access broker; the server decrypts in memory for authorized sessions.

Open a terminal or desktop

From More, Connections you can open an SSH shell, and from the RDP screen a remote desktop. Both are brokered by the server, so the SSH key or password never reaches the phone. First-use host keys are shown for confirmation. You can also browse files over SFTP and file connections, and review recordings. Recordings are not private, in either vault mode, and their digests are sealed into the audit chain.

Manage your account

Under Settings: profile, sign-in methods, passkeys, two-factor authentication, API tokens, active devices (and revoking them), appearance and AutoFill. Organization members can reach teams, shares, just-in-time access requests, emergency access and the audit view; admins also see live sessions and recording review.

AI

The AI copilot and settings follow the organization’s setting: a self-hosted Ollama, or cloud AI only when an administrator has opted the organization in. Where cloud AI is available, the app shows what a cloud call would expose beside the opt-in.

Limits to know

• Push notifications are not part of the app.
• Android is also listed as coming soon.

Feature clip

There is no mobile feature clip yet.

Where to go next

• Vault overview
• Connecting to hosts
• Session recording