End-to-end encryption, one-time code sign-in, and redundant storage, explained for the people who have to trust us with their secrets.
Envless encrypts every variable value client-side, on your device, before anything is uploaded. Your secrets are turned into ciphertext locally, so our servers store and replicate only encrypted data and never see plaintext. Connections are protected with TLS in transit, and sign-in is passwordless, so there is no account password to leak, reuse, or phish. We cannot read your values, and neither can anyone who compromises our infrastructure. This page explains exactly how that works, what we can and cannot see, and how we handle access, durability, and disclosure.
DATABASE_URLpostgres://user:pa55w0rd@…
STRIPE_SECRET_KEYsk_live_4eC39HqLyj
DATABASE_URLu7Qf1s9xKd0pRz4mA2…
STRIPE_SECRET_KEYb3Xn8vTq5Lw1Ye6Cj0…
Seven guarantees, each one a property of the design rather than a promise we ask you to take on trust.
Every variable value is encrypted on your own device, before it leaves your machine. Encryption happens in the CLI, the SDKs, and the dashboard, so what travels to us is already ciphertext. Decryption happens locally too, when you pull values or run your app. Plaintext exists only on your devices and inside your running processes, never on our servers or in our databases.
Our server stores ciphertext, along with metadata and the structure of your projects and environments. It can see that a variable changed, who changed it, and when, but not the value itself. We cannot read, log, or recover your plaintext secrets, and we cannot hand them to anyone, because we never hold the keys needed to decrypt them.
Envless accounts have no password to steal, reuse, or phish for later replay. You sign in with a one-time code emailed to you, a single-use magic link, or Google or GitHub OAuth, so there is no long-lived shared secret sitting in a credential dump. Combined with client-side encryption, account access alone still does not reveal a single variable value without the workspace passphrase. TLS protects every connection between your devices, the CLI, the SDKs, and our API in transit.
Roles carry 44 distinct permissions across every resource, so you decide who can read variables, who can change them, and who can publish or roll back a version. Products can additionally be marked private, which isolates them to an explicit list of members regardless of workspace role. Every variable change is attributed and versioned, so you can see what changed, who changed it, and when, and roll back to a published version when you need to.
Your encrypted data is stored redundantly, so the loss of any single copy does not lose your secrets. The property that matters most here is what every copy contains: ciphertext, and only ciphertext. Redundancy therefore adds durability without widening exposure, because reaching any one of them still yields encrypted data that cannot be decrypted without keys that never leave your devices.
Some organizations arrive with requirements that go beyond the standard plans, such as a specific storage region, a signed agreement, or a support commitment. We would rather scope those with you than list them as shipped features. Tell us what you need and we will confirm in writing what we can support, and what we cannot, before you commit to anything.
We welcome reports from security researchers and will work with you to confirm and fix valid issues quickly. If you find a vulnerability, contact us directly rather than disclosing it publicly first. Our formal compliance program is in progress, and details on our posture and any available attestations can be shared with customers on request. We would rather under-promise here than claim a certification we do not hold.
Straight answers about how Envless protects your secrets.
No. Variable values are encrypted on your device before upload, and our servers store only ciphertext. We never receive the keys needed to decrypt them, so we cannot read, log, or recover your plaintext values, and we cannot disclose them to a third party even if we were compelled to.
An attacker who reached our storage would find ciphertext, not plaintext. Without the keys held on your devices, that data cannot be decrypted. Even account access alone reveals no plaintext, because decryption needs the workspace passphrase that our servers never hold. Encrypted copies are stored redundantly, and because every copy is ciphertext, reaching any one of them does not expose your secrets.
Not today. Envless is a hosted platform and is not self-hostable yet. Self-hosting is something we are exploring; we will document it clearly if and when it ships, rather than imply it exists now.
We describe our compliance work as in progress rather than claiming certifications we may not hold. Customers can request details on our current security posture, controls, and any available attestations. If a specific framework matters to your purchase, contact us and we will tell you exactly where we stand.
All connections between your devices, the CLI, the SDKs, the dashboard, and our REST API use TLS. Values are also already encrypted client-side before they are sent, so data in transit is protected at two layers: the encrypted payload itself and the encrypted transport carrying it.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.