Security and custody
Your account approves fleet changes. Each device has its own identity, and private releases are encrypted before upload. Here is what those protections mean and what your team still controls.
What your team controls
Use account permissions to decide who may deploy, and access policies to decide which devices may open private releases. These are different permissions. Review every approval request before confirming it.
Account, device and encryption keys explained
Who holds which key
| Key | Held by | Used for |
|---|---|---|
| Your account key | You: in your wallet (Slush, an extension wallet) or, with Google sign-in, an ephemeral browser key with a zero-knowledge proof issued through Mysten Labs' Enoki service. | Registering devices, publishing versions, deploying, funding and changing permissions. Changes require the applicable account approval. Browsing and other read-only views do not require a payment approval. |
| Device key | Each device. It is generated on the device at first boot, stored with owner-only permissions (with key isolation, readable only by a separate signer service), and is not uploaded by the SuiFleet client. PKCS#11 tokens are supported as an alternative. | Signing the device's reports, health and log archives, and decrypting releases addressed to it. |
| Enrollment claim keys | You, in the downloaded credentials file, until each device uses its claim once. | Letting a device prove it is the one you reserved during batch enrollment. |
| Decryption key shares | Independent Seal key servers, each holding a share; a threshold of them must agree. | Releasing a decryption key only to identities the on-chain access policy allows. |
SuiFleet never holds your account key or any device key, and the console never asks for a recovery phrase. SuiFleet holds the capability to upgrade its own smart-contract packages; upgrades keep existing interfaces compatible and are planned, checked against the chain and reviewed before they are signed.
What the records prove
- Release authority. Only accounts holding the right on-chain capability or delegation can publish or deploy. Delegated decryption rights never grant publishing or deployment rights.
- Integrity. Devices verify each recipe and artifact against the digests recorded on chain before running anything, and reject versions they do not support.
- Device reports. A result or health report is signed by the device's own key and checked against its current registration. It proves which device identity reported, not that the hardware booted correctly or is uncompromised; software keys are not hardware attestation.
- History. Transactions provide tamper-evident public history. Live objects and latest health snapshots can change or be retired; older history may require an archival provider. Do not treat the dashboard as an indefinite archive.
Your responsibilities
- Your platform updater (SWUpdate, RAUC or your own scripts) owns OS installation, partitions, reboots, boot confirmation and firmware rollback. SuiFleet runs the commands you configure and records what they report.
- Protect the browser you sign in from: a compromised browser or extension can ask you to approve harmful transactions. Read what you approve, and disconnect on shared machines.
- Keep enrollment credential files out of source control and delete them once devices have enrolled.
- Remember that on-chain names, group memberships and targets are public. Use confidential delivery for anything proprietary.
Revocation
You can revoke a device or its capability, remove it from groups, close enrollment policies and revoke unused claims. Revocation stops future authority; it cannot recall a release a device has already decrypted.
Current status
- SuiFleet runs on Sui testnet as a public preview. Mainnet service has not launched.
- Production Seal key-provider selection, real-hardware signers (TPM or secure element) and physical-device acceptance are still being validated.
- Contract security checks run on every change (Move security gates, CI security scanning). No independent third-party audit has been published yet.
Found a problem? See how to report it.