Security

KeySentry is built with security as the primary constraint, not an afterthought. Every design decision in the encryption layer reflects that.

Encryption

  • AES-256-GCM for per-value encryption.
  • Envelope encryption. A master key wraps per-value data encryption keys. Master key rotation re-encrypts data keys without re-encrypting every value.
  • Zero-knowledge mode. RSA key pairs per project. The server holds only the public key. The customer holds the private key. The server never sees plaintext secret values.

Transport

All API traffic requires TLS. The config delivery endpoint supports conditional requests with ETag and If-None-Match to minimize data transfer. Endpoint tokens are opaque, high-entropy bearer credentials.

Authentication

Dashboard access uses JWT with short-lived access tokens and rotating refresh tokens. Password hashing uses Argon2. All token operations use symmetric signing with a 32+ character secret.

Audit

Rule evaluations, key changes, token rotations, and encryption operations produce audit log entries with event metadata. Secret values are never included in audit logs.

Vulnerability disclosure

If you find a security issue, report it to hello@keysentry.in. We will acknowledge within 48 hours and provide a timeline for a fix.

Back to home →