How syncs work
A sync is one mapping: one direction, one environment, one target. Conflict policies, activation modes, preview and apply, and audit events.
A sync is one mapping on a connection: one direction, one environment in your workspace, one target in the other system. A connection carries any number of mappings. Credentials: connect methods.
Directions
| Direction | Effect |
|---|---|
import | We read names and values from the store into your environment. |
export | We write names and values from your environment into the store. |
Each provider page names its supported directions. Export-only providers are those whose vendor offers no way to read a stored value back.
Conflict policies
We apply the policy when a name already exists.
| Import policy | Effect |
|---|---|
skip_existing | Leaves your value unchanged. |
new_version | Writes the incoming value as a new version; the old one stays in history. |
fail | Stops the run; changes nothing. |
| Export policy | Effect |
|---|---|
create_only | Writes names absent from the store; touches nothing else. |
overwrite | Writes every name we hold for the environment, replacing existing values. |
overwrite_and_prune | Writes every name we hold, then deletes store names we have no key for. |
overwrite_and_prune deletes store values unknown to us. Read the preview before you apply.
Activation
Most platforms bind values at deploy time, so a successful export may change nothing your running app sees. Each provider page declares its mode.
| Activation | Effect |
|---|---|
immediate | The running app sees the value at once. |
on-next-deploy | The value arrives with the next deploy. |
on-request | We can deploy to activate it; the sync form asks you first rather than redeploying production as a side effect. |
restart-on-write | The write restarts the workload. |
Preview and apply
Preview is a dry run over names only: the plan lists creates, replaces, and deletes. Apply runs that plan. Each mapping shows its run history. We record preview and apply in your audit log as integration.run_enqueued and integration.run_applied.
Export boundary
An export mapping requires you to acknowledge that values leave our control. After export, the other system's access rules and logs apply, and we cannot report who read them.
Exports work because we can decrypt your values, the same property that serves penv pull; this is not zero-knowledge. See encryption in the cloud.
Permissions
When you verify a connection, we probe the permissions listed on the provider page. A blocking permission fails the check; any other degrades one named feature.
Integrations
A connection is a credential we hold for another store, used to import your values from it or export them to it. Index of integration concept pages.
Connect methods
The two credential kinds, the five methods by which your credential or grant reaches us, and how our console confirms completion.