Your API keys are in someone's chat history.
One safe place for the keys and settings your apps need.
- Frank's laptoppulled · 09:41:12v4
GitHub Actionsci-runner-7 · no stored key · 09:41:14v4
Vercelproduction · 09:41:15v4- api-01server · no stored key · 09:41:15v4
- 01
Paste the .env you already have.
It becomes rows you can edit in place, each one encrypted on its own. The pasted text is never stored.
Import a .env · production- STRIPE_SECRET_KEYencrypted
- DATABASE_URLencrypted
- RESEND_API_KEYencrypted
- SENTRY_DSNencrypted
- REDIS_URLencrypted
- 02
Add your people. Connect your machines.
Only what each person needs.
PEOPLEACCESS- Adaowner
- Frankproduction
- Femistaging only
MACHINES0 SEATS- GitHub Actions
GitLab CI- Vercel
- api-01
- 03
Change it once.
Every laptop, pipeline and server picks it up. The chat thread stops mattering.
STRIPE_SECRET_KEYUpdated by Frank, 09:41v3v4- Frank09:41:12v4
- GitHub Actions09:41:14v4
- Vercel09:41:15v4
- API09:41:15v4
- 04
Append-only audit log.
Every reveal is written down with who, what, and when. Someone leaves, and the day their access ended is on the record.
09:41:14ci-runner-7readproduction/*09:41:12FrankrevealedSTRIPE_SECRET_KEY09:40:58vercel · productionreadproduction/*09:38:02api-01readREDIS_URL09:37:40AdachangedDATABASE_URL09:35:11ci-runner-3readstaging/*09:31:27Femirevealedstaging/RESEND_API_KEY09:30:05gitlab-runnerreadproduction/*09:24:49api-02readDATABASE_URL09:20:16FrankreadSENTRY_DSN09:12:33ci-runner-7readproduction/*09:05:08Tobiaccess endedacme/*08:58:41vercel · previewreadstaging/*08:51:19AdarevealedSTRIPE_SECRET_KEY
Zero charge for machines.
A team of 5 people and 47 machines pays for 5.
How it is protected.
- sk_live…
Each value is encrypted under its own key.
That key is wrapped by AWS KMS.
Every reveal is written down with who, what, and when.
The server can decrypt your values to serve your machines. See security details and the threat model.
Questions
Before you ask.
01What is Penv Cloud?
One safe place for the keys and settings your apps need. Change it once. It lands everywhere your code runs. Your team, your CI and your servers read from it; nobody pastes a key into a chat again.
02Do I have to change my code?
Your app reads its settings exactly the way it used to. Your app keeps reading environment variables the way it does today. Penv puts the right values in front of it when it starts.
03How does CI get secrets without a key I have to store?
Your CI logs in like a person does, with no key to steal. A pipeline presents the identity token its platform already gives it and receives a credential that lives for minutes. A server with nothing to present enrols once with a keypair.
04Can you read my secrets?
The server holds the envelope and can decrypt your values to serve your machines. That is what makes `penv pull` work. Each value is encrypted under its own key, and every reveal is written down with who, what, and when.
05What about coding agents like Claude Code or Cursor?
An agent runs as you, so penv narrows what it can reach: there is no .env file to read, values are scrubbed from the output it captures, and when it asks to see one, a person approves in the console first.
06What does it cost?
Up to three people free. Machines don't take a seat. Billed per human seat. Not per identity. Every plan is encrypted the same way; plans differ in how much you keep and for how long.
07Do I need to know the penv command line tool?
Works with the Penv CLI (Open Source) tool. New to penv? Check out the docs.
08Can I leave?
Yes. One command writes a plain .env with your current values, in the format every tool already reads. Nothing about your secrets is locked in a shape only we understand.