Security
Security at KeyEnv
Security is not a feature—it's the foundation of everything we build. Learn how we protect your most sensitive data.
Zero Knowledge Architecture
We designed KeyEnv so that we mathematically cannot access your secrets.
All encryption and decryption happens on your device. Your secrets are encrypted before they ever leave your machine, and they remain encrypted on our servers. We never have access to your encryption keys or the unencrypted content of your secrets.
This means that even if our servers were compromised, attackers would only obtain encrypted data that is computationally infeasible to decrypt without your keys.
Encryption Standards
We use industry-standard, battle-tested cryptographic algorithms.
AES-256-GCM
All secrets are encrypted using AES-256-GCM, providing both confidentiality and integrity protection. This is the same standard used by governments and financial institutions worldwide.
TLS 1.3
All data in transit is protected by TLS 1.3, the latest version of the Transport Layer Security protocol, ensuring secure communication between your devices and our servers.
Argon2id
Key derivation uses Argon2id, the winner of the Password Hashing Competition, providing resistance against GPU and ASIC attacks.
Encryption at Rest
Beyond client-side encryption, all data stored on our servers is additionally encrypted at rest using platform-level encryption.
Infrastructure Security
Our infrastructure is designed with security as a first principle.
- Hosted on secure, SOC 2 compliant cloud infrastructure
- Regular security audits and penetration testing
- Automated vulnerability scanning and patching
- DDoS protection and Web Application Firewall (WAF)
- Automated backups with encryption
- Strict access controls and audit logging for all systems
Access Control
Fine-grained permissions ensure the right people have the right access.
- Role-Based Access Control (RBAC): Assign roles (Admin, Developer, Viewer) to control who can read, write, or manage secrets
- Environment Isolation: Separate secrets by environment (development, staging, production) with independent access controls
- Service Tokens: Create scoped, revocable tokens for CI/CD pipelines with minimal required permissions
- Audit Logging: Complete audit trail of who accessed what secrets and when
Responsible Disclosure
We welcome security researchers to help us keep KeyEnv secure.
If you discover a security vulnerability, we ask that you disclose it to us responsibly. Please do not publicly disclose the issue until we have had a chance to address it.
Report a Vulnerability
Send your report to [email protected] with:
- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any suggested fixes (optional)
We aim to acknowledge reports within 24 hours and provide updates on our progress toward resolution.