Security

Envlet encrypts each variable on its own. It records each resolution without placing values in the audit log.

Variable encryption

Separate ciphertext

Envlet encrypts every value with AES-256-GCM under a per-project data key. Each variable has its own ciphertext.

Context binding

Envlet binds each encrypted value to its project, environment, and variable name. Decryption fails if the ciphertext moves to a different context.

Key rotation

Envlet rotates encryption keys while each project’s encrypted variable values stay in place.

Token protection

Envlet shows a raw token only when it creates the token. The database stores the token digest.

Each resolution token is scoped to one project and one environment. Every token expires.

Organization access

An organization can require every member to use TOTP.

Each member must enroll an authenticator app when the organization requires TOTP. A member cannot access that organization until enrollment is complete.

Resolution audit log

Every resolution creates an audit record with:

The identity
The project
The environment
The source
The timestamp
The key names

Secret values never enter the audit record.

Deletion and audit retention

Before Envlet deletes an organization, it archives the organization’s resolution records as JSONL. The archive does not contain secret values.

The archive expires after 13 months.

One-time shares

You can send one value or a small set of values without creating an account for the recipient.

You choose the expiry when you create the share. The share closes after the first successful read, or it stays readable until the deadline that you set.