Tavi

Security

Encrypted to your computer.

Every session is encrypted between your phone and your computer, pinned to the computer's own key. Nothing in between can read it, including us.

Pairing

The host on your computer has its own key pair, made on the computer and kept in ~/.tavi. The pairing code that npx tavi-host connect shows carries the computer's public key, so scanning it tells your phone exactly which key to expect.

You then compare the fingerprint, a short code like 7F3A 91C2 · 0BE4 5D17, on both screens. If they match, the phone has the right computer. A code pairs one phone, for five minutes, and disappears from the screen once it's used.

When it pairs, your phone gets its own credential, beside a device key made in the phone's Secure Enclave that never leaves it. Through the relay, the credential counts only together with that key.

Every connection

Every connection is TLS 1.3, ended by the host on your computer with the key your phone pinned when it paired. The phone refuses any other key, so nothing in between can pose as your computer. Your phone's credential travels inside that encryption.

The same encrypted session runs whichever way it travels:

  • Direct. On the same network, your phone connects straight to your computer.
  • Through Tavi. Anywhere else, through Tavi's relay on Cloudflare.
  • Fast path. For a terminal in active use, through Cloudflare's TURN service.
The three ways Tavi connects your iPhone to your computer One encrypted session runs from the iPhone to the computer by one of three routes: directly on the same network, through Tavi's relay on Cloudflare, or by the fast path through Cloudflare's TURN service. The relay and TURN pass the encrypted bytes on without being able to read them. The keys sit only at the two ends. Direct same network Tavi relay on Cloudflare Fast path Cloudflare TURN iPhone Computer Mac or Linux
  • Your session, encrypted end to end
  • Passes bytes it can't read

The relay and TURN pass the encrypted bytes along without being able to read them.

What the relay can and can't see

Can't see

  • What you type
  • What your terminals show
  • Your code, files and previews
  • Your prompts and the agents' replies
  • Your phone's credential

Sees, to connect you

  • Your computer's identifier and public key
  • Your phones' public keys
  • The IP addresses each end connects from
  • When, for how long, and how much data

What the relay stores, and what Cloudflare keeps, is in the Privacy Policy. You can turn the relay off on your computer, and then your phone reaches it only on the same network.

On your phone

The app keeps its credentials in the iPhone's Keychain, on that device only. Turn on Face ID lock and Tavi locks whenever it goes to the background, and the app switcher doesn't show your terminal.

On your computer

  • The host's plain API listens only on the computer itself. Your phone always comes in through the encrypted, pinned connection.
  • Every API and terminal connection needs a credential. The computer keeps only hashes of your phones' credentials.
  • Previews of a dev server go through a separate door that forwards nothing without a ticket your phone got over the encrypted connection. Each ticket is bound to one phone and one localhost port, and ends when the preview closes.
  • Don't expose the host's local ports, 8787 and 8788, directly to the internet.

If something leaks

Treat the host token and each phone's access as shell access: whoever holds one and can reach the computer can run commands as you.

  • A phone is lost. On the computer, tavi devices lists the paired phones and tavi devices revoke <id> cuts one off without touching the others.
  • The token or ~/.tavi leaked. tavi identity reset replaces the computer's key and host token and revokes every phone. Pair the phones you keep again with npx tavi-host connect.

Open source host

The host runs with shell access on your computer, so it should be readable. tavi-host is open source under the Apache License 2.0, and anyone can audit what it does.

Report a vulnerability

Email security@tavihost.com. It reaches the same inbox as support@tavihost.com. Please include what you found, how to reproduce it, and what it would let someone do.

  • Test only against computers and phones you own.
  • Don't access other people's data, and don't degrade the relay for others.
  • Give us reasonable time to fix the problem before you publish it.

We read every report and reply as soon as we can. Our security.txt has the same details.