Security
KeyStackz exists for one reason: your API keys deserve better than a .env file in a Slack DM. Here is exactly how we protect them — no hand-waving, no badges we don't hold.
Encryption at rest
Every secret is encrypted with AES-256-GCM envelope encryption under a per-user key the moment it arrives. Plaintext values are never logged, never displayed after entry, and never sent to a model or chat window. What we store is ciphertext; what you pull is decrypted only for the services you've toggled on, only at pull time.
Monitoring without exposure
We watch for errors so we can fix them — but our error monitor never sees your secrets. Every report is scrubbed before it leaves our servers: key material, tokens, request bodies, and local variables are stripped, and session recording is off. A crash tells us what broke, never what you stored.
Scoped, revocable tokens
Your token is encrypted at rest under your per-user key — the same AES-256-GCM protection as your keys. It is never displayed again after creation; you can copy it straight to your clipboard, and every copy is recorded in your audit log. Verification uses a separate one-way hash, so a database breach alone yields neither usable tokens nor readable keys. Tokens remain scoped to a single project and revocable at any time.
KeyLockz
Your keys, secured in one click. Any token or stack can be locked from your dashboard with one click — state-of-the-art AES-256-GCM keeps the underlying secrets sealed, and while locked, tokens can't be copied and stacks can't be touched. Unlocking demands a fresh identity re-check, on the spot. keystackz pull keeps flowing the whole time, so a lock never disrupts a running app or CI — and every lock, unlock, and copy is written to your audit log.
Fail-closed pulls
If two active services define the same environment variable, keystackz pull blocks and names both services instead of silently overwriting one secret with another. Your .env.local is never quietly wrong.
We never mint keys
KeyStackz never fetches or generates credentials from your providers. You create each key in the provider's own dashboard and paste it once; we store it encrypted. We never hold authority to create credentials in your accounts — a deliberate safety choice that caps the blast radius of any incident.