How it works

Three tiers.
One honest
direction of flow.

The most important sentence on our site: nothing connects inbound to your home. Here's the whole picture.

Tier 01 · At home

Your home

Home Assistant + ÆtherCasa Bridge, on your own hardware.

  • Home Assistant (yours)
  • ÆtherCasa Bridge (MIT)
  • All device state lives here
  • Opens outbound TLS only
home-initiatedoutbound →
Tier 02 · Relay

ÆtherCasa Cloud

Thin, stateless, E2EE. Carries messages between your home and your clients.

  • No device-state storage
  • Encrypted payloads only
  • Auth + identity + routing
  • Falls back gracefully
client← connects in
Tier 03 · Client

Your devices

Web, iOS, Android, Mac. Every device, same interface.

  • Signs in with a passkey
  • Receives encrypted state
  • No device-state cached in cloud
  • Works offline on LAN

▚ the whole system · drawn once, drawn plainly

Why outbound

Why home-initiated,
and not the other way.

Most "remote access for Home Assistant" approaches boil down to opening a port on your router, or running a VPN. Both work. Both expose you.

A home-initiated outbound tunnel is the same pattern your phone uses to receive a text message. Your router never sees an incoming connection. Our cloud never has the power to reach in.

◎Nothing inbound

No ports forwarded. No UPnP. Your router stays closed.

◇Nothing stored

We don't keep device states, logs of when you came home, or what you watched. We're a relay, not a database.

◈Nothing we can turn into evidence

If our servers are subpoena'd, there's no device-state history to hand over. Because there isn't one.

◯Self-hostable, forever

The bridge and the clients are MIT. You can run your own relay. If we disappear, you keep your home.

Setup, start to finish

Four steps.
About ten minutes.

01

Install the bridge

A Home Assistant add-on. One click from the add-on store; your HA restarts once.

02

Pair with your account

The bridge shows a short pairing code. You enter it on aethercasa.app. That's the trust handshake.

03

Pick a room to start

ÆtherCasa reads your existing HA areas. Confirm the ones you want visible. Skip the rest.

04

Invite who lives there

Send a passkey link. They pick a role. You're done — the surface works on every device they own.

Plain English

The vocabulary,
explained.

We'll use these words on the security page and in support emails. Might as well define them up front.

Bridge
A tiny program that runs on your Home Assistant. The only piece that knows your device states.
Relay
Our cloud. It shuttles encrypted messages between bridges and clients. It does not read them.
Outbound tunnel
A connection your home opens to our cloud. We can't reach in; you reach out.
Passkey
A cryptographic credential stored on your device. Phishing-resistant by design. No passwords anywhere.
E2EE payloads
Commands and state are encrypted on one end and decrypted on the other. Our cloud sees ciphertext.
LAN-first
When your phone is on the same Wi-Fi as your home, it talks to the bridge directly — not through us. Faster. Quieter.