Talos holds root SSH keys and cloud credentials for your entire fleet. That makes it the most sensitive system you will run, which is the reason this page is specific about what the software does, how it stores secrets, and, in equal detail, what it cannot defend you against.
SEE IT RUN
The security model1:10
Setting up Talos1:58
How Talos runs0:49
THREAT MODEL
What it does and does not defend.
WHAT TALOS PROTECTS AGAINST
✓A stolen laptop. Keys live encrypted on the server, never synced to a workstation.
✓An engineer who leaves. Revoke one account; every key they used stays where it is.
✓Accidental destructive actions. Approval gates can require a second person before an irreversible action runs.
✓Silent changes. Every action is attributed, timestamped and queryable afterwards.
✓Credential sprawl across scripts, CI files and shared password managers.
WHAT TALOS DOES NOT PROTECT AGAINST
!A compromised Talos host. Whoever gets root on this machine gets the key ring. Protect it as one of your most sensitive systems.
!A malicious administrator. Someone with approve and execute rights can do damage; the ledger records it but does not prevent it.
!Weak or reused operator passwords. Enable SSO or enforce hardware keys; Talos cannot fix a shared password.
!Vulnerabilities in the software you deploy. Talos governs the deployment, not the application.
!Your cloud provider. If AWS is breached, an encrypted credential in Talos does not help you.
The right-hand column matters most: it shows where to add your own controls.
DATA RESIDENCY
Nothing is sent to us.
Your browserthe operator
Your Talos instanceyour hardware
Your serversover SSH
✕ NOTHING IS SENT TO TALOSFLEET: no vendor endpoint, no telemetry upload, no licence server
ENCRYPTION AT REST
Encrypted under a key only you hold.
Stored credentials are encrypted with your ENCRYPTION_KEY, and sessions are signed with a separate JWT_SECRET. Both are generated by you at install time; the backend refuses to start on a missing or published-default value. Secrets are decrypted in memory for the duration of a job and never written to disk, a log line, or a job payload.
✓SSH private keys
The keys used to reach every managed host.
✓Cloud credentials
AWS, Azure, GCP and Oracle access keys and service accounts.
✓Database passwords
Connection secrets for every managed database.
✓AI provider keys
Your Anthropic, OpenAI or Google API keys, if the AI Engine is enabled.
ACCESS CONTROL
501 permissions, across 35 resource families.
Permissions are granular enough to be useful and scoped per resource, so “can restart containers on these three servers” is expressible without granting anything else. Users can hold different roles in different organizations. The largest families are the cloud managers.
Azure36
Oracle Cloud35
GCP35
AWS35
Kubernetes33
Hypervisor25
Docker25
Databases18
Deployments16
Sites9
Servers9
Projects8
Platform7
Pipelines6
Environments6
Apps6
AI Engine6
Largest families shown. The remainder cover jobs, audit, API keys, GitHub, backups and organization administration.
Per-resource scoping
Every permission can be narrowed to named servers, namespaces, sites or databases rather than granted fleet-wide.
Multi-org roles
A contractor can be an operator in one client organization and have no visibility at all into the others.
APPROVAL GATES
Two-person verification.
01Proposed
02Reviewed
03Approved by a second humanREQUIRED
04Executed
05Recorded
The approver must independently hold the permission for the action: approving is not a privilege that substitutes for being allowed to do the thing.
AUDIT LEDGER
Every action, attributable.
ACTOR
ACTION
RESOURCE
TIMESTAMP
RESULT
k.minos
site.backup
acme.erp
2026-01-12 04:12:07Z
SUCCESS
r.dalca
gate.approve
proposal #318
2026-01-12 09:41:55Z
SUCCESS
r.dalca
k8s.rollout.restart
prod-eu/deploy/web
2026-01-12 09:42:02Z
SUCCESS
j.pallas
db.restore
billing (live)
2026-01-11 17:20:31Z
DENIED
system
backup.verify
acme.erp
2026-01-11 04:26:44Z
SUCCESS
Append-only, and attributed down to the individual job that caused the change.
Tenant isolation
Organizations are isolated in the data access path itself rather than by a filter each caller has to remember. The same checks apply whether you have one organization or fifty.
Runs without internet access
Talos needs outbound SSH to the hosts it manages and nothing else. With images mirrored into your own registry it runs on an isolated network, and the AI Engine is simply unavailable unless you point it at a model endpoint you control.
RESPONSIBLE DISCLOSURE
Report it privately first.
Mail the address below and you will get a human reply. A fix or a mitigation ships before any public disclosure, and you will be credited in the changelog unless you would rather not be. As a small team, we commit to taking every report seriously and answering it, rather than promising a contractual response time.
Not when you self-host. Self-hosted Talos runs on your hardware, against your database, and the software makes no outbound connection to us. There is no licence server and no account on our side that could hold a copy. (Talos SaaS, when it launches, will be a separate option that TalosFleet runs.) You can verify this by running the containers with outbound networking blocked: everything except managing your own servers continues to work.
What if I lose my encryption key?
Your stored credentials are unrecoverable. There is no backdoor, no recovery key and no reset, so you would re-enter every SSH key and cloud credential by hand. Back ENCRYPTION_KEY up somewhere separate from the database dump: kept together, a single loss takes both and a single leak exposes both.
Is there telemetry?
There is a telemetry subsystem, and it is worth being precise about what it does. It records job traces, command output and change attribution so the AI Engine can reason about your fleet and so you can answer "what changed, and who changed it". It writes exclusively to your own Postgres; the module contains no HTTP client and no outbound endpoint. Nothing is sent to us, because there is nowhere for it to be sent.
Has Talos been independently audited?
No. Talos is a young project, and a third-party audit has not yet been done or scheduled. If you are evaluating Talos for something regulated, weigh that accordingly.
What happens to my credentials if I stop using Talos?
Delete the instance and they are gone with it. The data lives in your Postgres in a documented schema; there is no external service holding a copy. Rotate the keys afterwards anyway, as you would after decommissioning any system that held them.