Security
How Appentic protects your environment variables, passwords and backups, and what you control.
Your secrets are your environment variables and the passwords of your databases, key value stores and storage services. Appentic encrypts them, limits who can read them, and records every time someone does.
Your environment variables
- Encrypted with your project's own key. Every project has a key of its own, and no other project's data is encrypted with it. Values are never stored in readable form, in our database or in its backups.
- Read only where they're needed. Your services receive their variables when they deploy or restart. A deploy that can't load its variables fails rather than starting without them.
- Destroyed with the project. Deleting a project deletes its key, so no copy of its values can be read again.
Who can read a value
| Owner | Collaborator | Coding agent | |
|---|---|---|---|
| Add, replace and delete variables | Yes | Yes | Yes, with set_env_var |
Reveal a value or export a .env file | Yes, after a recent sign-in | No | No |
| See a database, store or storage password | Yes, after a recent sign-in | No | No |
| Open a shell | Yes, after a recent sign-in | Yes, after a recent sign-in | No |
A recent sign-in means you signed in to Appentic in that browser within the last couple of hours. A session that stayed open longer, or one brought back by "remember me", can't reveal anything. Sign out and sign in again.
Every reveal and export is recorded, and each shell you open appears in the service's events. An export also emails the workspace's owner. If you get one you didn't make, change the password of the account you sign in with, then replace the project's secret values.
A shell, and code you deploy, run inside your service, so they can read its environment like your app does. Only invite collaborators you'd trust with your code.
Backups
- Your databases' backups are encrypted with a key unique to each database. See Backups.
- Appentic's own records are backed up hourly to a separate location, encrypted before they leave.
Your own key
Add a Vault to put your project's encryption under a key you control, and keep your API keys and passwords in it as secrets, which Appentic can't read back. It protects your app's own data, and the keys that protect your environment variables, file storage, backups and volumes. You can rotate it, see every use in its Activity, and disable it in an emergency to stop all of them at once.
What you can do
- Keep secrets in environment variables, never in your repository.
- Use Only the services I choose for a secret that only some services need. See Who receives a variable.
- Replace a value if you think it has leaked. Services restart with the new one within seconds.
- Remove collaborators who no longer work on the project. See Workspaces.