Secrets · Plans and data
Data and privacy
Secrets keeps what you put in it, encrypted value by value. Here is what it keeps, how, and what to do when a value must go.
What Secrets keeps
Loading what it keeps…
How values are protected
- Each value is encrypted with AES-256-GCM before it's stored, under its project's own key. That key is itself encrypted under a master key used for Secrets alone.
- A value is bound to its place, its environment and its name: copied onto another variable's row, it doesn't open.
- The history keeps earlier values the same way, encrypted, and a roll back moves them without opening them.
- A copy of the database or a backup shows names only, never a value.
- Service tokens are kept only as a hash. A token can't be read back, by anyone.
A value leaves Secrets only for a token of its environment, for someone who shows or downloads it, or onto a page when it's Visible. Each of those but the last is recorded: see The audit log.
What isn't encrypted
Names are not secret, so they're stored as they are: variable and environment names, token labels, who made each change and when, and the audit log's entries. Never put a secret in a name or a label.
Your users' data
Secrets keeps nothing about your app's users: no SDK sends it anything, and it holds only what your team types or imports. The people it names are your team, by their My Beast accounts. Keep personal data out of values: they are for configuration.
Erasing a value
Removing a variable takes it out of its environment and out of every read from then on. Its earlier values stay in the history, encrypted, which is what lets you roll the removal back. Changing a value works the same way: the old one stays in the history.
If a secret has leaked
To have a value erased from the history too, write to us at hello@my-beast.com with the project, the environment and the variable's name. Never the value.