Security
Three responsibilities. What happens after load. Data minimization. No compliance claims.
Last updated: 2026-09-20
Three responsibilities
- Secret Security - protecting stored secret values with encryption and access controls.
- Platform Security - protecting the getmyenv service itself: the servers, the database, and the code.
- Admin Security - protecting super_admin accounts that administer getmyenv, with MFA and audit logging.
After load
After a secret is injected into your application process, that process holds it.
Data minimization
We keep the smallest amount of data that makes the product work. Secret values are stored as ciphertext. Webhook payloads exclude secret values. Audit logs redact values.
Named primitives
Vault encryption uses standard primitives, not a custom cipher:
- Argon2id derives a key-encryption key (KEK) from your Vault password (RFC 9106).
- AES-256-GCM wraps the project encryption key (PEK) and encrypts each secret (NIST SP 800-38D).
- Envelope pattern: a random PEK is wrapped by the password-derived KEK. Libraries:
@noble/ciphers,hash-wasm.
No compliance claims
getmyenv does not claim any specific compliance standard. If you need certified compliance, evaluate the product against your own requirements.