FAQ

How Arqut connects, what it can see, and how to verify what you install.

Getting started

What is Arqut?

Arqut gives you secure remote access to services running on your home network — Home Assistant, Proxmox, TrueNAS, Grafana, Node-RED, Zigbee2MQTT, and anything else that speaks HTTP. You install one connector at home, and reach those services from your phone or desktop anywhere, without exposing them to the internet.

Do I need to open ports or set up port forwarding?

No. Arqut establishes the connection outbound from your network, so there are no inbound firewall rules to open, no port forwarding, and no dynamic DNS to maintain. Nothing on your network is exposed to the public internet.

Does it work behind CGNAT?

Yes. Arqut uses WebRTC’s ICE negotiation — the same mechanism video calls use to connect two devices that both sit behind NAT. When a direct path cannot be established, the connection falls back to a TURN relay over TCP/TLS.

What do I install, and where?

One component on your home network — Arqut Edge — as a Home Assistant add-on, a Docker container, or a binary on Linux (including a Raspberry Pi). Then the Arqut app on the devices you want to connect from — iOS, Android, Windows, or macOS. Pairing is a QR code scan.

How does Arqut find my services?

Arqut Edge discovers HTTP services on your local network automatically and lists them in the app. There are no config files to write and no command line required. You choose which discovered services to enable.

Security and privacy

Is my traffic encrypted?

Yes, in two layers. Your session runs inside a WireGuard® tunnel, which is itself carried over an encrypted WebRTC transport. The WireGuard tunnel terminates on your own devices — Arqut Edge at home and the app in your hand.

What can Arqut see?

Not the contents of your traffic. Most connections are peer to peer — data goes straight between your app and your home network and never touches our infrastructure. When a direct path cannot be established, traffic is relayed through a TURN server instead.

A TURN relay forwards packets without being a party to their encryption. Your session is protected by two independent layers: the encrypted WebRTC transport, and a WireGuard tunnel inside it. The keys for both are negotiated directly between the app in your hand and Arqut Edge on your network. The relay holds neither, so what passes through it is ciphertext it has no way to read.

What the relay does see is connection metadata — the IP addresses and ports at each end, and the timing and volume of traffic. Our servers also hold your account data and run the signaling that introduces two peers to each other.

You do not have to take our word for any of this. The relay is the pkg/turn package in arqut-server-ce, it is Apache-2.0 licensed, and it is the same code that runs our hosted relay. And if you would rather no third party sit in the path at all, run the Community Edition — then the relay is yours.

What data do you store, and where?

Account data — your user ID, a hashed password, and contact information — plus standard web server logs. It is stored on servers located in Germany. Deleting your account permanently removes that data. The full detail is in our Privacy Policy.

Who is behind Arqut?

Arqut is a product of semilimes AG, a company registered in Switzerland under commercial register number CHE-145.189.822.

How do I report a security vulnerability?

Please do not open a public issue. Both Community Edition repositories carry a SECURITY.md with a private reporting channel, and you can email contact@semilimes.com with SECURITY in the subject line. We acknowledge reports within three business days.

What happens when I share access with someone?

Sharing grants access to the specific services you choose, not to your whole network. The free plan allows sharing with up to three users; the Team plan removes that limit. Arqut Edge keeps access and event logs so you can see who connected and when.

Open source and licensing

Is Arqut open source?

The Community Edition is. Both arqut-server-ce and arqut-edge-ce are published under the Apache License 2.0, which includes an explicit patent grant. You can run the entire stack — signaling, STUN, and TURN — on your own infrastructure with no dependency on us.

How do I verify what I am installing?

Every Community Edition release ships with a SHA256SUMS file, a Sigstore signature over those checksums, an SPDX software bill of materials, and a GitHub build provenance attestation.

You can confirm a download matches its published checksum, confirm the checksums were signed by the release workflow itself, and confirm which commit and tag produced the binary. The exact commands are in each repository’s README under Verifying Downloads. Signing is keyless, so there is no long-lived private key that could be stolen.

What third-party code is included?

Each repository carries a NOTICE and a THIRD_PARTY_LICENSES file listing every component actually compiled into the released binaries, generated from the build closure rather than written by hand. No GPL, LGPL, or AGPL code is distributed with either project.

Plans and self-hosting

What is included for free?

Peer-to-peer connections, unlimited devices and services, and sharing with up to three users. No time limit.

What does the Team plan add?

For $3 per month you get sharing with an unlimited number of users, TURN relay for networks where a direct connection cannot be established, and email support. You are paying for relay bandwidth — if your connections go peer to peer, the free plan already covers you.

What is the Community Edition?

A fully self-hosted deployment. You run your own signaling, STUN, and TURN servers, so no traffic and no account data touches our infrastructure. It is free, Apache-2.0 licensed, and has no feature restrictions. See the self-hosted installation guide.

What do I need to self-host?

A public server with a static IP and a domain name for the server component — a small VPS is enough — plus a local machine for the Edge component. Full prerequisites and setup steps are in the installation guide.