Docs
How encryption works
How Eanvi protects secret values at rest and when they can be revealed.
How encryption works
Eanvi encrypts every secret value before it is stored. Key names, descriptions, and tags stay searchable; the sensitive value itself does not sit in plaintext in the database.
At a glance
| Guarantee | What it means for you |
|---|---|
| Encryption at rest | Secret values are encrypted with industry-standard AES-256-GCM |
| No plaintext in lists | Dashboards and list views show masked values |
| Explicit reveal | Plaintext appears only when you reveal, pull, or export — on purpose |
| Audited access | Reveals and sensitive exports are recorded in audit activity |
| Tamper detection | Modified ciphertext fails integrity checks and will not decrypt |
What is encrypted
| Data | Encrypted? |
|---|---|
| Secret value | Yes |
Secret key name (e.g. DATABASE_URL) | No — needed to find and manage secrets |
| Description and tags | No |
| Audit logs | Never include plaintext secret values |
When can someone see a value?
Only principals with permission, through an explicit action:
- Reveal in the dashboard
eanvi pull/eanvi export/eanvi list --reveal- SDK calls that intentionally fetch decrypted values
Casual browsing of a project does not expose plaintext.
What this protects against
- A database backup or dump alone is not enough to read secret values
- Accidental copy-paste of list screens does not leak full secrets
- Unauthorized changes to stored ciphertext are rejected on decrypt
Access still depends on strong account security: protect API keys, use least-privilege roles, and review audit activity. See Security best practices.