Security
What protects a value in Penv Cloud, one plain sentence at a time, with a link to the detail behind each one.
Here is what protects a value, one plain sentence at a time. Each sentence links to the page that carries the mechanism behind it.
Six sentences
Every value is sealed under a key of its own, and that key is wrapped by a key belonging to your workspace. See encryption in the cloud.
The seal is bound to the exact place the value lives, so a row lifted into another environment will not open. See where a value lives.
Every row is fenced by your workspace id inside the database, and a query that arrives without one returns zero rows.
Your CI logs in like a person does, with no key to steal. See machine identities.
Every reveal is written down with who, what, and when. See the record of who did what.
Encryption is the same on every plan. Plans differ on where the data sits, on whether you hold the wrapping key, and on the paperwork that comes with it.
Where the detail lives
| Page | What it answers |
|---|---|
| What the server can see | What penv can open, and what a database reader gets. |
| Values in a CI build | What holds inside someone else's pipeline, and what cannot. |
| Who processes what | Every third party in the path and what each one can access. |
| Compliance posture | What is in place today, and what is not. |
| Report a vulnerability | Where to send it and what happens next. |
The marketing security page is the public summary, written for a reader who has not installed anything yet. These pages are the detail behind it.
What is not built today
State this to anyone evaluating penv, so the answer arrives here rather than in month three.
| Thing | Where it stands |
|---|---|
| Dedicated infrastructure | Shared. There is no private instance and no choice of region. |
| Private networks | penv reaches your services from the public internet. |
| Chained record entries | The column that would chain each entry to the one before it is reserved and unused. |
| An error reporter | None. SENTRY_DSN is a placeholder nothing reads, so an exception is visible in the platform request log and nowhere else. |
| Operational log shipping | None. A failed-auth spike or an odd read volume is found by reading logs by hand. |
| An audit report | None is held. Read compliance posture. |
Next: what the server can see.