SECURITY
Your keys never leave your infrastructure.
Talos holds root SSH keys and cloud credentials for your entire fleet. That makes it the most valuable target you will run, and it is the reason this page is specific about what the software does, how it stores secrets, and — in equal detail — what it cannot defend you against.
THREAT MODEL
What it does and does not defend.
WHAT TALOS PROTECTS AGAINST
✓A stolen laptop. Keys live encrypted on the server, never synced to a workstation.
✓An engineer who leaves. Revoke one account; every key they used stays where it is.
✓Accidental destructive actions. Gates require a second human before anything irreversible.
✓Silent changes. Every action is attributed, timestamped and queryable afterwards.
✓Credential sprawl across scripts, CI files and shared password managers.
WHAT TALOS DOES NOT PROTECT AGAINST
!A compromised Talos host. Whoever gets root on this machine gets the key ring. Treat it as a tier-0 asset.
!A malicious administrator. Someone with approve and execute rights can do damage — the ledger records it, it does not prevent it.
!Weak or reused operator passwords. Enable SSO or enforce hardware keys; Talos cannot fix a shared password.
!Vulnerabilities in the software you deploy. Talos governs the deployment, not the application.
!Your cloud provider. If AWS is breached, an encrypted credential in Talos does not help you.
The right-hand column is the important one. Any vendor who cannot write it has not thought about it.
DATA RESIDENCY
Nothing egresses.
Your Talos instanceyour hardware
✕ NO PATH CROSSES THIS BOUNDARY — no vendor endpoint, no telemetry upload, no licence server
ENCRYPTION AT REST
Encrypted under a key only you hold.
Stored credentials are encrypted with your ENCRYPTION_KEY, and sessions are signed with a separate JWT_SECRET. Both are generated by you at install time — the backend refuses to start on a missing or published-default value. Secrets are decrypted in memory for the duration of a job and never written to disk, a log line, or a job payload.
✓SSH private keys
The keys used to reach every managed host.
✓Cloud credentials
AWS, Azure, GCP and Oracle access keys and service accounts.
✓Database passwords
Connection secrets for every managed database.
✓AI provider keys
Your Anthropic, OpenAI or Google API keys, if the AI Engine is enabled.
ACCESS CONTROL
352 permissions, across 29 resource families.
Permissions are granular enough to be useful and scoped per resource, so “can restart containers on these three servers” is expressible without granting anything else. Users can hold different roles in different organizations. The largest families are the cloud managers, where one provider alone accounts for more permissions than most tools expose in total.
Azure36
Oracle Cloud35
GCP35
AWS35
Kubernetes33
Hypervisor25
Docker25
Databases18
Deployments16
Sites9
Servers9
Projects8
Platform7
Pipelines6
Environments6
Apps6
AI Engine6
Largest families shown. The remainder cover jobs, audit, API keys, GitHub, backups and organization administration.
Per-resource scoping
Every permission can be narrowed to named servers, namespaces, sites or databases rather than granted fleet-wide.
Multi-org roles
A contractor can be an operator in one client organization and have no visibility at all into the others.
APPROVAL GATES
Two-person verification.
03Approved by a second humanREQUIRED
The approver must independently hold the permission for the action — approving is not a privilege that substitutes for being allowed to do the thing.
AUDIT LEDGER
Every action, attributable.
| ACTOR | ACTION | RESOURCE | TIMESTAMP | RESULT |
|---|
| k.minos | site.backup | acme.erp | 2026-01-12 04:12:07Z | SUCCESS |
| r.dalca | gate.approve | proposal #318 | 2026-01-12 09:41:55Z | SUCCESS |
| r.dalca | k8s.rollout.restart | prod-eu/deploy/web | 2026-01-12 09:42:02Z | SUCCESS |
| j.pallas | db.restore | billing (live) | 2026-01-11 17:20:31Z | DENIED |
| system | backup.verify | acme.erp | 2026-01-11 04:26:44Z | SUCCESS |
Append-only, and attributed down to the individual job that caused the change.
Tenant isolation
Organizations are isolated in the data access path itself rather than by a filter each caller has to remember. The same guards run whether you have one organization or fifty, so the isolation path is exercised continuously instead of only when a second tenant appears.
Runs without internet access
Talos needs outbound SSH to the hosts it manages and nothing else. With images mirrored into your own registry it runs on an isolated network, and the AI Engine is simply unavailable unless you point it at a model endpoint you control.
RESPONSIBLE DISCLOSURE
Report it privately first.
Mail the address below and you will get a human reply. A fix or a mitigation ships before any public disclosure, and you will be credited in the changelog unless you would rather not be. This is a small project — the commitment is that reports are taken seriously and answered, not a contractual response window it cannot honour.
EMAIL
security@talosfleet.site
WHAT HAPPENS NEXT
acknowledged as soon as it is read
assessment once reproduced
fix or mitigation before public disclosure
QUESTIONS WE WOULD RATHER ANSWER HERE
Including the awkward ones.
Can you see my data?
No. Talos is self-hosted — it runs on your hardware, against your database, and the software makes no outbound connection to us. There is no hosted offering, no licence server and no account on our side that could hold a copy. You can verify this by running the containers with outbound networking blocked: everything except managing your own servers continues to work.
What if I lose my encryption key?
Your stored credentials are unrecoverable. There is no backdoor, no recovery key and no reset — you would re-enter every SSH key and cloud credential by hand. Back ENCRYPTION_KEY up somewhere separate from the database dump: lose both together and you have lost the credentials, store them only together and you have gained nothing from encrypting them.
Is there telemetry?
There is a telemetry subsystem, and it is worth being precise about what it does. It records job traces, command output and change attribution so the AI Engine can reason about your fleet and so you can answer "what changed, and who changed it". It writes exclusively to your own Postgres — the module contains no HTTP client and no outbound endpoint. Nothing is sent to us, because there is nowhere for it to be sent.
Has Talos been independently audited?
No. This is a young project and a third-party audit is neither done nor scheduled, which we would rather state plainly here than have you discover later. If you are evaluating Talos for something regulated, weigh that accordingly.
What happens to my credentials if I stop using Talos?
Delete the instance and they are gone with it. The data lives in your Postgres in a documented schema; there is no external service holding a copy. Rotate the keys afterwards anyway, as you would after decommissioning any system that held them.