Overviewsince cloud@2026-09-10
Security
How we protect your stored values, and where each mechanism is documented.
Penv Cloud, our hosted secret store, is a provider penv reads. We can decrypt your values to serve them to your machines. This is not zero-knowledge encryption.
| Protection | Page |
|---|---|
| We seal each value under your workspace's data key, which a key management service wraps | Encryption in the cloud |
| We bind each sealed value to its full address, so bytes copied elsewhere do not open | Where a value lives |
| Your CI authenticates with a platform-signed token, not a stored key | Machine identity |
| Every reveal lands in your audit log | The audit log |
| We encrypt identically on every plan; plans differ on key ownership (BYOK), capacity, audit retention, and compliance paperwork | Billing and plans |
Security pages
| Page | Scope |
|---|---|
| What we can see | What we can open, and what someone with a copy of our database gets. |
| Values in a CI build | Delivery channels, runner limits, credential lifetimes, SHA pinning, the audience rule. |
| Who processes what | Every third party in our request path and what it can access. |
| Compliance posture | Controls in place, certification status, retention. |
| Report a vulnerability | Where to report, what to send, how fast we answer. |
Our security page is the public summary.