Security at Envshed
We take the security of your secrets seriously. Here's how we protect your data at every layer.
Encryption
- AES-256-GCM encryption at rest for all secret values
- TLS encryption for all data in transit
- Encryption keys managed separately from encrypted data
- Unique initialization vector (IV) per secret value
Authentication
- Multi-factor authentication (TOTP) support
- JWT sessions that last 7 days and renew while in use, end after 7 days idle, and require a new sign-in after 30 days
- Sign-in codes are rate limited per IP and per address. Repeated wrong codes cancel the outstanding ones.
- SHA-256 hashed API and service tokens with optional expiration
Audit Logging
- Every change, admin action, and CLI or API read is logged
- Tamper-proof audit trail with cryptographic hash chaining
- Audit logs never expire automatically
- IP address and user agent tracking for all actions
Infrastructure
- Hosted on Vercel with automatic DDoS protection
- Cloudflare CDN and DNS with WAF protection
- Security headers: HSTS, CSP, X-Frame-Options, and more
- Database access restricted to application servers only
Access Control
- Role-based access control (RBAC) at organization level
- Fine-grained project-level permissions (admin, editor, viewer)
- Per-environment access overrides
- Scoped service tokens for CI/CD with read or read/write permissions
Data Handling
- Full account deletion with data anonymization
- Database backups only ever hold encrypted secret values
- Secret values are never stored or logged in plaintext
- Configurable trash retention window (1 to 90 days)
Responsible Disclosure
If you discover a security vulnerability, please report it responsibly. We appreciate your efforts in keeping Envshed and our users safe. Please do not disclose the issue publicly until we have had the chance to address it.
Last updated: November 2026