What Penv Cloud Is
Penv Cloud is our hosted secret store for the penv CLI: what we store, what we can decrypt, and what we bill.
We run Penv Cloud, a hosted secret store. The penv CLI reads it as a provider and hands your values to a process on your laptops, pipelines, and servers. Without a @penv= header, penv stays in local mode and reads your value files instead.
What we store
| Data | Detail |
|---|---|
| Values | Every write adds a version; we keep the history. |
| Schema | Each key's schema as penv push sends it. Your next push overwrites console edits to type, sensitivity, rotation, or description. |
| Audit log | Our append-only record of reads, writes, member and billing changes. Retention depends on your plan (the audit log). |
What we can decrypt
We seal every value with envelope encryption under your workspace's data key, wrapped by KMS. We can decrypt your values to serve them to your machines, so this is not zero-knowledge (encryption in the cloud).
Every plan gets the same encryption. Enterprise adds a wrapping key you own (BYOK).
What we bill
We bill per human seat. Machine identities are free (machine identity).
CLI
penv run validates values against the nearest .env.schema and starts your command with them in its environment. How penv works.
Addressing and access
An address is {org}/{project}/{environment} plus the key name. The @penv= header names org and project; the environment comes from precedence.
You need a role on the environment, granted on the project's Access page. Without one we refuse, and penv exits 6 with environment_refused (exit codes). A machine reads only its bound environment.