What Penv Cloud is
The store beside the binary: what the cloud keeps, and what stays the same inside your app.
One safe place for the keys and settings your apps need.
The penv binary runs on your laptop, and on every pipeline and server your code ships to. Penv
Cloud is where the values it hands to your process are kept, so the file on one laptop stops being
the record.
What the cloud keeps
| What | Detail |
|---|---|
| The values | Every write is a new version. History is never deleted. |
| The schema for each key | Every decorator from .env.schema, including the type and whether a key is sensitive. |
| The record of who did what | Every read and write lands a row. So does every member change and every billing change. Rows are only ever added. |
The console renders and edits the same schema the binary pushed, so a person fixing a type in the
browser and a developer editing .env.schema are describing one thing.
What the binary does
penv finds the nearest .env.schema above your working directory, checks every value against it,
and starts your command with those values in that command's environment. Nothing is written to
disk in the clear unless a person asks for it with penv pull.
Your app reads its settings exactly the way it used to.
What the server can see
The server holds your values and can serve them to your machines on demand. Encryption in the cloud says exactly what that means and where the honest limit sits.
Encrypted, each value under its own key, on every plan. A free workspace and a paid one get the same protection for a value. Plans differ on isolation and on who holds the wrapping key, and Enterprise decides where the data sits.
Machines never take a seat
Three people free. Machines never take a seat. A pipeline or a server gets its own identity and its own short-lived credential, and it is never counted as a person.
Environments
An address is {org}/{project}/{environment}, plus the key name. The @penv= header at the top
of .env.schema names the first two. The environment is whichever of these says something first:
--envon the command linePENV_ENVin the environment penv itself was started withdevelopment, when neither of the first two says anything
A person reads an environment when they hold a role scoped to it, granted on that project's Access
page in the console. Without one the server answers 403 and penv reports environment_refused. A
machine reads only the environment its credential is bound to.