Docs
How encryption works
How Eanvi protects secret values at rest and when they can be revealed.
Eanvi uses a 3-level envelope encryption hierarchy backed by AES-256-GCM with Authenticated Additional Data (AAD) binding. Every secret value is encrypted using a unique, ephemeral Data Encryption Key (DEK), ensuring tenant isolation and instant key rotation without touching underlying secret ciphertexts.
At a glance
| Guarantee | What it means for you |
|---|---|
| 3-Level Envelope Encryption | Platform Root Key $\to$ Organization Key $\to$ Secret DEK $\to$ Secret Value |
| Tenant Isolation | Every organization has an independent cryptographic key wrapped under the platform root key |
| AAD Context Binding | Secret ciphertexts are bound to organizationId, projectId, and secretId to prevent cross-tenant and cross-secret transposition attacks |
| No Plaintext in Lists | Dashboards and list views show masked values |
| Explicit Reveal | Plaintext appears only when you reveal, pull, or export — on purpose |
| Zero-Downtime Rotation | Platform and Organization keys can rotate without re-encrypting secret values |
| Audited Access & Failures | Reveals, rotations, and decryption failures are securely recorded in audit logs |
| Tamper Detection | AES-256-GCM 128-bit authentication tags verify integrity and authenticity on every decrypt |
Encryption Hierarchy
[Platform Root Key] (Environment / KMS)
│ (HKDF-SHA256 derived wrapping key)
▼
[Organization Key] (256-bit AES-GCM, unique per org)
│ (Wraps DEKs with org-bound AAD)
▼
[Data Encryption Key (DEK)] (256-bit AES-GCM, unique per secret)
│ (Encrypts payload with secret-bound AAD)
▼
[Secret Plaintext Value]
What is encrypted
| Data | Encrypted? |
|---|---|
| Secret value | Yes (with per-secret DEK + AAD) |
| Secret DEK | Yes (with Organization Key + AAD) |
| Organization Key | Yes (with Platform Root Wrapping Key) |
Secret key name (e.g. DATABASE_URL) | No — needed to find and manage secrets |
| Description and tags | No |
| Audit logs | Never include plaintext secret values or keys |
When can someone see a value?
Only principals with permission, through an explicit action:
- Reveal in the dashboard
eanvi pull/eanvi export/eanvi list --reveal- SDK calls that intentionally fetch decrypted values
Casual browsing of a project does not expose plaintext.
What this protects against
- Database Compromise: A database dump alone is not enough to read secret values without platform master keys.
- Cross-Tenant Attack: Transplanting ciphertext from one organization or secret to another immediately fails AAD verification.
- Accidental Leakage: List screens and audit logs never contain plaintext secret values.
- Unauthorized Tampering: Any ciphertext or tag manipulation is rejected fail-closed.
Access still depends on strong account security: protect API keys, use least-privilege roles, and review audit activity. See Security best practices.