Pre-alphaZekno is in active development
Zekno gives small teams push-button deploys, roles and deploy history on their own servers. Secrets are encrypted and deploys are signed on your machine, so our service never holds a key.
Open source (MIT). Starting with Hetzner and Docker Compose.
Stored sealed. No key to open it.Everything the attacker can read
Agent waitingSignature verifiedRefused: no team signature
Your server decrypts with its own key and runs your containers.
In October 2026, Zeabur, Railway and Northflank each had customer secrets read out of their control planes. All within 17 days.
Same flaw every time: the platform could decrypt every customer's secrets, so one break-in reached everyone.
Zekno can't decrypt yours. A breach of our service finds nothing it can open.
How it works
The service in the middle holds nothing it can open.
The desktop app encrypts each secret for your server's public key before anything leaves your machine.
Your secrets are encrypted before they leave your machine, so our database holds only ciphertext. Copy all of it and there is still nothing to open.
Readable secrets found: none
Every deploy is signed on your machine. The agent on your server refuses anything unsigned, including anything we send.
Checking signature
Your servers never depend on Zekno at runtime. If we are offline, the desktop app deploys to the agent directly.
Deploying through ZeknoDeploying directly to the agent
A desktop app, teammates with roles and a full deploy history. You pay your provider directly for the servers.
We publish what the design protects against, and what it does not. Pick a scenario.
What the attacker controls
Outcome
No secrets exposed.
The database holds only ciphertext.
What the attacker controls
Outcome
No secrets exposed.
The database holds only ciphertext.
The control plane still sees metadata: server addresses, app names, deploy times and team membership.
The convenience of a managed platform, with the control of your own scripts.
| Question | Zekno | Managed platforms, e.g. Railwaysource | Kamal or your own scriptssource |
|---|---|---|---|
| Who can decrypt your secrets | Your team and your servers | The platform | Whoever holds the files |
| Who can run code on your servers | Only deploys your team signed | The platform | Anyone with SSH access |
| If the vendor is breached | No secrets, no code execution | Whatever the platform can decrypt | No vendor |
| If the vendor is down | Apps keep running | Depends on the platform | No vendor |
| Team roles and deploy history | Included | Included | You build it |
| Runs on servers you own | Yes | Usually not | Yes |
Everything that runs on your device or in your browser is public under the MIT license. The control plane is closed, and it never holds a key, so you don't have to trust it.
View on GitHub (opens in a new tab)Short answers. The README has the full security model.
No. The mechanism is end-to-end encryption plus digital signatures. The name refers to the service having zero knowledge of your secrets.
Zekno is pre-alpha. Early-access teams get a hands-on migration from Railway, Zeabur or Northflank.