Secrets encryption with AES-256-GCM and AWS KMS.
How we encrypt, isolate and log your values.
We can decrypt your values.
We use a server-side envelope, so we can serve values to your machines and show one in an audited reveal. That is what makes penv pull work. This is not zero-knowledge encryption.
On Enterprise the wrapping key can be yours. Disabling it ends our access immediately. We cache no copy.
01Encryption
We encrypt each value with AES-256-GCM under a data key that belongs to your workspace alone. An AWS KMS key wraps that data key. We never write the plaintext data key anywhere, and we clear it from memory when the request ends, including when it fails.
Every plan gets the same encryption. Address binding and tenant isolation are identical on every plan too.
02Address binding
The full parameter address is the additional authenticated data. A ciphertext copied to another environment, project or organization fails its authentication tag.
We show that value as present but undecryptable, never as missing, so you never overwrite a value you still have.
03Tenant isolation
Postgres row-level security scopes every query to your workspace, set per transaction. It fails closed: a request with no workspace scope reads 0 rows.
04Machine identity
A machine identity is bound to one project and environment. We show its token once and keep only a SHA-256 hash. Revocation is immediate and final.
| Endpoint | Lifetime | Returns |
|---|---|---|
| POST | 15 minutes | Machine credential |
| POST | 5 minutes | Values |
A host with nothing to attest enrols with an Ed25519 keypair and a generation counter. This detects a cloned key. It does not prevent one.
05Dynamic secrets
We generate a dynamic credential on request and store none of it. Reading, setting or deleting one as a stored value returns 409.
06Audit
We log every read, write, token and member action. The database refuses every edit and every deletion. Every write is a new version.
- Free
- 14 days
- Pro
- 180 days
- Enterprise
- Custom, streamed to your SIEM
Enterprise streams NDJSON batches signed to the Standard Webhooks spec.
07Outbound requests
Before we connect to an address you give us, we refuse private, loopback, link-local and CGNAT ranges and 169.254.169.254. We never follow redirects.
08Compliance
No SOC 2 report yet; Enterprise gets our security questionnaire and a DPA. Further compliance commitments are set by contract. Traffic is TLS in transit and envelope-encrypted at rest.
- Logical access
- Integrity of the log
- Key management
- Boundary protection
- Vendor management
- Secret handling: we never log a value