Security and access model

Values marked sensitive are encrypted by the Keyrua API through Google Cloud KMS before they are stored in the database. Values marked non-sensitive are stored without KMS encryption. Variable names, project information, and change metadata are not encrypted by this secret-value encryption flow.

The API uses its service identity to call KMS for both encryption and decryption. Sensitive values are decrypted for authorized reveal and export requests. Plaintext therefore exists in the API during processing, in the requesting browser or CLI, and in any exported file or process receiving it.

Keyrua is not a zero-knowledge service: its backend can decrypt stored sensitive values. KMS protects the stored ciphertext; it does not make the service operator cryptographically unable to read values. See Google's KMS encryption and decryption documentation.

Requests require an authenticated user and active membership in the requested organization. Membership is checked through Clerk. Organization administrators manage invitations and member roles.

Members share access to the organization's projects and all their environments. Secret writes are permitted for organization administrators and members. There are no per-project or per-environment access restrictions, and environment names do not create separate permission boundaries.

If a contractor must see Client A but not Client B, put those teams in separate organizations. Each organization has its own plan and limits. Do not put both clients into one organization and rely on project names to separate access.

Secret creation, updates, and deletion produce records with the actor, timestamp, variable key, project, and environment. The write and its change record share a database transaction.

Records do not contain previous values and do not record secret reads. They are not a tamper-proof archive. Deleting a project deletes its secrets and change history, so this history cannot restore an earlier value or a deleted project.

The web application runs on Cloudflare Workers, and the API runs in Cloudflare Containers. Clerk handles authentication and organization membership, Stripe handles subscription payments, and Google Cloud KMS performs encryption and decryption for sensitive values.

Application hosting and KMS key location are separate configurations. This page does not promise EU-only processing. Read the privacy policy for personal-data processing information, or contact us to discuss your residency and procurement requirements.

Export each project environment as a .env file from the web app or retrieve it with the CLI. Exports contain plaintext values. Keep them out of version control and protect them on disk.

An existing local export can keep a local workflow running during a service outage. New retrievals depend on Keyrua and its providers. The CLI retrieves values when you pull or start a command; it does not automatically refresh a running process.

There is no customer-operated backup restore workflow or public self-hosting installation guide at present. Keep an authorized recovery copy if your workflow needs one.

Removing organization membership blocks subsequent requests to that organization. It cannot erase files or invalidate API keys and passwords someone already retrieved. Revoke or rotate previously shared credentials at the service that issued them when required.

The CLI stores an authentication token in .keyrua.json. Protect that file and never commit it. CLI tokens expire after 90 days; membership removal and credential rotation address different parts of offboarding.

Report a suspected issue to info@keyrua.dev. Include the affected workflow and steps to reproduce using dummy data. Please do not send actual credentials by email.

To evaluate the workflow before importing credentials, follow the web quickstart.