'%3e%3cpath%20fill='%23eee'%20d='m0%200%208%2022-8%2023v23l32%2054-32%2054v32l32%2048-32%2048v32l32%2054-32%2054v68l22-8%2023%208h23l54-32%2054%2032h32l48-32%2048%2032h32l54-32%2054%2032h68l-8-22%208-23v-23l-32-54%2032-54v-32l-32-48%2032-48v-32l-32-54%2032-54V0l-22%208-23-8h-23l-54%2032-54-32h-32l-48%2032-48-32h-32l-54%2032L68%200H0z'/%3e%3cpath%20fill='%230052b4'%20d='M336%200v108L444%200Zm176%2068L404%20176h108zM0%20176h108L0%2068ZM68%200l108%20108V0Zm108%20512V404L68%20512ZM0%20444l108-108H0Zm512-108H404l108%20108Zm-68%20176L336%20404v108z'/%3e%3cpath%20fill='%23d80027'%20d='M0%200v45l131%20131h45L0%200zm208%200v208H0v96h208v208h96V304h208v-96H304V0h-96zm259%200L336%20131v45L512%200h-45zM176%20336%200%20512h45l131-131v-45zm160%200%20176%20176v-45L381%20336h-45z'/%3e%3c/g%3e%3c/svg%3e)
Security
Venicee is built around a simple premise: file transfer software sits close to sensitive data — server credentials, private keys, business files, and infrastructure access. Security should be visible in the product, not buried in a readme you only read after something goes wrong.
This page summarizes how Venicee handles encryption, credential storage, trust decisions, and privacy. For configuration details, see Settings.
Encrypted connections by default
Venicee supports SFTP (SSH File Transfer Protocol) and FTPS (FTP over TLS) in addition to plain FTP when a legacy server requires it. For new connections, SFTP is the default in the site manager.
| Protocol | What it protects |
|---|---|
| SFTP | File data and credentials in transit over SSH |
| FTPS (explicit) | TLS upgrade on the standard FTP port |
| FTPS (implicit) | TLS from the first byte on the dedicated port |
| FTP | No transport encryption — use only when the server offers no alternative |
When you connect, Venicee negotiates encryption with the server using the protocol you chose. Saved site profiles store the protocol and port so you do not have to remember defaults for each server type.
Host key and certificate verification
Before Venicee trusts a server, it checks the remote identity:
- SFTP / SSH — the server’s host key fingerprint is compared against known values. If the key is new or has changed, you see a prompt and decide whether to trust it. Approved keys are stored locally in
trusted_hosts.json. - FTPS / TLS — certificate validation follows standard TLS rules. You are prompted when a certificate is unknown or no longer matches what you trusted before.
Venicee does not silently accept changed or unknown host keys. That choice is yours, every time the identity does not match what is on file.
Credential vault
Saved site passwords are never written in plain text to sites.json. They are stored inside an encrypted vault protected by a master password you choose.
| Aspect | Behavior |
|---|---|
| Encryption | AES-256-GCM |
| Master password | Never stored on disk |
| Unlock | Required to use saved passwords; optional skip leaves the app usable without vault access |
| Auto-unlock | After a successful unlock, Venicee may store a protected key in the Windows Credential Manager so the vault can unlock on the next launch — still under your control on the device |
SSH private keys for SFTP are referenced by file path in the site profile. Protect those key files with the same care you would on any system that uses key-based authentication.
Data stays on your device
Venicee does not require an account. There is no sign-in flow, no vendor cloud that holds your connection list, and no background upload of file names or transfer metadata to us.
Configuration and state live under your app data folder (on Windows: %AppData%\Venicee\), including:
- Site connection profiles (
sites.json) - Encrypted credentials (
vault.json) - Trusted host keys (
trusted_hosts.json) - Automation jobs, themes, language packs, and plugin data
Under normal use, we do not receive your FTP/SFTP credentials, private keys, or file contents. You are responsible for securing the device, backups, and who has access to your user profile.
No telemetry
Venicee is designed without usage analytics or crash-reporting pipelines tied to a vendor account. The app should not phone home about what you transfer, where you connect, or how often you open it.
If that ever changes in a future version, it would be documented clearly before release — not slipped in quietly.
Verifiable downloads
Every release published on the download page includes a checksums.txt file with SHA-256 hashes. Before you run a new build, compare the hash of your download against the published value so you know the archive was not altered in transit.
See Getting started for a PowerShell example.
Open source and auditability
Venicee’s source code is available on GitHub. You can review how connections are made, how the vault is implemented, and how host trust is recorded. We think security claims should be checkable, not just stated on a marketing page.
Swiss made, privacy-first mindset
Venicee is made in Switzerland. The product is shaped by a privacy-first approach: minimize data collection, keep sensitive material local, and avoid business models that depend on profiling users or locking basic features behind accounts.
That does not replace your own security practices — strong passwords, patched systems, least-privilege server accounts, and careful handling of private keys still matter — but it defines what Venicee will and will not do with your data by design.
Your responsibilities
Venicee can protect data in transit and at rest on your machine, but it cannot fully secure an environment you control. In practice, that means:
- Use SFTP or FTPS whenever the server supports it.
- Treat host-key and certificate prompts seriously; do not approve changed keys without understanding why they changed.
- Choose a strong vault master password and protect your Windows user session.
- Restrict access to SSH private key files and to
%AppData%\Venicee\. - Verify release checksums before installing updates.
For licensing and liability terms, see the EULA.
Related pages
- Why Venicee — product goals and philosophy
- Settings — vault, sites, trusted hosts, and data files
- Getting started — install and verify downloads