penv-cloud

Your API keys are in someone's chat history.

One safe place for the keys and settings your apps need. Nothing about how your app reads a value moves.

See how it worksJoin the waitlist

Three people free. Machines never take a seat.

acme/api-gateway/production

saved · just now
  • DATABASE_URLv2
  • STRIPE_SECRET_KEYchanged by Frank · 09:41v3v4
  • RESEND_API_KEYv1
  • SENTRY_DSNv1
  • REDIS_URLv3
  1. Frank's laptoppulled · 09:41:12v4
  2. GitHub Actionsci-runner-7 · no stored key · 09:41:14v4
  3. Vercelproduction · 09:41:15v4
  4. api-01server · no stored key · 09:41:15v4
  5. 4 places updated. 0 keys pasted.
penv-cloud

Your CI logs in like a person does, with no key to steal.

  1. 01

    Paste the .env you already have.

    It becomes rows you can edit in place, each one encrypted on its own. The pasted text is never stored.

    Import a .env · production5 values found
    • STRIPE_SECRET_KEYencrypted
    • DATABASE_URLencrypted
    • RESEND_API_KEYencrypted
    • SENTRY_DSNencrypted
    • REDIS_URLencrypted

    the pasted text is never stored

  2. 02

    Add your people. Connect your machines.

    Only what each person needs. Your CI logs in like a person does, with no key to steal.

    PEOPLEACCESS
    • Adaowner
    • Frankproduction
    • Femistaging only
    MACHINES0 SEATS
    • GitHub Actions
    • GitLab CI
    • Vercel
    • api-01
  3. 03

    Change it once.

    Every laptop, pipeline and server picks it up. The chat thread stops mattering.

    STRIPE_SECRET_KEYchanged by Frank · 09:41v3v4
    • Frank's laptop09:41:12v4
    • GitHub Actions · ci-runner-709:41:14v4
    • Vercel · production09:41:15v4
    • api-0109:41:15v4
  4. 04

    Answer the questionnaire in one line.

    Every reveal is written down with who, what, and when. Someone leaves, and the day their access ended is on the record.append-only audit log · 7 days on Free, 90 on Pro

    who opened what · productionLIVE
    09:41:14ci-runner-7readproduction/*
    09:41:12FrankrevealedSTRIPE_SECRET_KEY
    09:40:58vercel · productionreadproduction/*
    09:38:02api-01readREDIS_URL
    09:37:40AdachangedDATABASE_URL
    09:35:11ci-runner-3readstaging/*
    09:31:27Femirevealedstaging/RESEND_API_KEY
    09:30:05gitlab-runnerreadproduction/*
    09:24:49api-02readDATABASE_URL
    09:20:16FrankreadSENTRY_DSN
    09:12:33ci-runner-7readproduction/*
    09:05:08Tobiaccess endedacme/*
    08:58:41vercel · previewreadstaging/*
    08:51:19AdarevealedSTRIPE_SECRET_KEY

One price per person.

A team of 5 people and 47 machines pays for 5. $18 a person a month billed yearly, $22 month to month. Three people free.

machines are free and unlimited on every plan

52 IDENTITIESINVOICE COUNTS 5
5 people · $18 each47 machines · $0

How it is protected.

  1. sk_live…

    Each value is encrypted under its own key.

    envelope encryption

  2. That key is wrapped by AWS KMS.

    your own key on Enterprise

  3. Every reveal is written down with who, what, and when.

    append-only audit log

The server can decrypt your values to serve your machines. The security page says exactly how.

Get your keys out of the chat.

Read the security pageJoin the waitlist

Three people free. Machines never take a seat.