Where plaintext exists
| Part of the system | What it handles |
|---|---|
| Your approved device | Displays terminal contents and sends your actions. It is a trusted endpoint. |
| The agent machine | Runs the CLI, reads the project and uses the credentials needed for provider requests. Miko software on this machine is part of the trusted endpoint. |
| Miko’s gateway | Relays the encrypted session. It cannot read the terminal payload carried by that end-to-end connection. |
| Previews of websites your agents start | Encrypted in transit and passed through Miko’s servers without being stored. Unlike terminals, previews are not end-to-end encrypted. |
| Miko’s account services | Handle account, plan and billing information, machine/resource state and connection metadata. |
| Your AI provider | Receives the requests the CLI sends, including project information or prompts needed for that work. |
“Miko cannot read your terminal connection” describes the relay’s boundary. It does not mean software running on your machine cannot access the data it needs to do its job. A compromised device or an agent given access to a secret is outside that relay protection.
Sign-in and key storage
Miko account sign-in and AI provider sign-in are separate. Miko supports passkey sign-in; new devices need approval through the trust flow. A provider subscription or API key authenticates the coding CLI, not your Miko account.
On Mac, provider sign-in runs through the provider’s own program. Codex uses one account-specific home and its own Keychain item; Miko checks status through the CLI and does not import or forward the login token. A separate profile for an account is not a filesystem sandbox.
For Host API-key accounts, the key is entered for a selected machine and stored in that Host’s local vault. The vault encrypts saved keys with AES-256-GCM and keeps its local encryption key on the same Host. The Host decrypts a key when its local provider proxy needs it. This is not protection from an administrator who controls that Host.
Host API-key accounts are machine-local; this vault is not a Cloud synchronization source. Signing out clears the saved secret for the API account. Removing the account removes its vault entry.
End-to-end terminal transport
Miko’s terminal channel uses Noise_IK_25519_AESGCM_SHA256. Pairing binds the connection to the machine’s identity; compare the three words on both screens. HTTPS and WSS carry the connection, while end-to-end encryption protects the session payload from the relay.
Approve new devices deliberately. Keep a recovery key private and separate from support messages. Device removal and account recovery are security actions, not ways to bypass approval of an unfamiliar device.
Cloud memory protection and verification
Every Miko Cloud machine is the same type, and every one uses AMD SEV-SNP as its memory-isolation layer, alongside disk encryption and the encrypted terminal connection. That holds for the machine in the 7-day trial and for every machine on the $20 and $100 plans. Cloud protection does not turn your own Mac or Linux server into a confidential VM.
The attestation download contains the public hardware report and links to AMD’s key distribution service for the matching certificates. AMD’s certificates are included only when the machine’s node has them cached. The report is bound to the machine, its Host keys and a fresh nonce. Check the downloaded evidence independently when you need hardware assurance.
What these layers do not protect
They do not prevent an approved endpoint, a vulnerable program or an authorized agent from disclosing data. They do not stop data you choose to send to an AI provider. On Cloud and Linux Host, new agents started from the web app use Never ask, which skips approval prompts, unless you choose another mode or the provider supports only its own default. On the Mac, Claude Code and Codex run without their normal approval prompts in Miko’s configured terminal flow; Grok Build keeps its own prompts. Only use project folders and machines you intend those agents to access.