We treat the contents of your secrets the way our customers do — as sensitive, encrypted, and access-controlled. Below is a transparent account of how we do that.
Encryption
Encryption at rest
Secret values are encrypted before they ever reach the database. We use AES-256-CBC via Node.js's built-in crypto module, with a fresh, random 16-byte initialization vector (IV) generated for every secret. The ciphertext is stored in Supabase as iv:ciphertext (both hex-encoded); plaintext values are never written to the database.
Encryption in transit
All client-server traffic is protected by TLS 1.3, enforced at the edge by both Vercel (frontend) and Railway (API). HTTP Strict Transport Security (HSTS) is enabled on API responses via Helmet.
Key management
The 32-byte master encryption key is supplied at runtime as the ENCRYPTION_KEY environment variable in our Railway deployment. The key is never committed to source control and is only present in process memory and the Railway secrets store.
Authentication
User authentication is delegated to Clerk. Sign-in supports email + password and any OAuth providers configured in our Clerk instance. Clerk handles password hashing, session issuance, and credential storage; Krypt never sees or stores plaintext passwords.
Sessions are short-lived JWTs signed by Clerk and verified on every API request. Tokens rotate automatically and can be revoked from the user's account settings.
Two-factor authentication (2FA) is available via Clerk and can be enabled by users from their account settings (TOTP authenticator apps).
Role-based access control
Every project membership has one of four roles, each with a distinct permission scope:
- Owner — full control of the project, including deletion, billing, and member management. Can read, write, and approve changes in any environment.
- Admin — can read, write, and manage members across all environments (development, staging, production).
- Member — can read and write secrets in development and staging. Production changes require submitting a change request for approval by an admin or owner.
- Viewer — read-only access to all secrets across every environment. Cannot modify secrets.
The change-request flow exists specifically so that production credentials are never modified unilaterally — every production write is reviewable, attributable, and reversible.
Infrastructure and sub-processors
Krypt is built on a small set of well-known, security-conscious sub-processors. Each one is chosen for a specific role and only receives the data it needs to perform that role.
- Clerk Inc. — user authentication, session management, and 2FA. Processes account identifiers, email addresses, and authentication metadata. Hosted in the United States (certified under the EU-US Data Privacy Framework).
- Supabase Inc. — primary application database (PostgreSQL). Stores project metadata, encrypted secret ciphertext, memberships, and audit logs. Hosted in eu-west-1 (Ireland).
- Stripe Payments Europe Limited — payment processing for paid plans. Receives billing identifiers and payment method data; Krypt never stores card numbers. Based in Ireland.
- Resend — transactional email delivery (invitations, password resets, change-request notifications, billing receipts). Hosted in eu-west-1 (Ireland).
- Railway — hosting for the Krypt API and background workers. Hosted in europe-west4 (Netherlands).
- Vercel Inc. — hosting for the Krypt web frontend and marketing site. Global edge network with EU presence.
- Sentry — error tracking and performance monitoring. Automatic redaction of sensitive request fields. Hosted in the United States.
For the full list of data categories shared with each sub-processor, see the Privacy Policy.
Audit and monitoring
Every change to a secret in Krypt is recorded in an append-only activity_logs table. Each entry captures the project, the acting user, the action performed (create / update / delete / reveal / approve), the affected secret key, the environment, and a timestamp, alongside any relevant metadata. We retain activity logs for the lifetime of the project so owners can review historical changes.
Error tracking on the API is provided by Sentry, with automatic redaction of authentication headers and any request fields whose names match password, token, secret, or key. Frontend Sentry integration is in progress.
Data handling
We collect the minimum data needed to operate Krypt and we do not sell or share user data with advertisers. For full details, see the Privacy Policy.
Your data, your control
- Export — you can download a complete JSON export of your account data (profile, projects, secret metadata, memberships, activity, webhooks) at any time via the
GET /api/me/exportendpoint, available from your account settings. - Deletion — you can delete your account and associated data via your account settings (
DELETE /api/me). Deletion cascades through owned projects, secrets, activity logs, and API keys before removing your Clerk record. - GDPR rights — UK / EU residents can exercise rights of access, rectification, erasure, restriction, portability, and objection. See Privacy Policy — Section 8.
Plaintext access
Krypt staff do not access plaintext secret values except in the limited circumstances disclosed in our Terms of Service — Section 6: with your explicit consent (e.g., a debugging session you initiate), or where compelled by valid legal process.
Report a security issue
We welcome responsible disclosure of security vulnerabilities and we aim to respond to all good-faith reports within 5 business days.
Email: security@krypthq.com
We will not initiate legal action against researchers who:
- Make a good-faith effort to avoid privacy violations and service disruption.
- Do not exploit a vulnerability beyond what is necessary to demonstrate the issue.
- Give us a reasonable opportunity to remediate before any public disclosure.
A machine-readable security contact is also published at /.well-known/security.txt per RFC 9116.
Security updates
We post material security changes — for example, a confirmed incident, a new sub-processor, or a major change to encryption — on this page.
Operated by KRYPTHQ LTD, a company registered in England and Wales (company number 17254962), with registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.