How Envless secures your secrets
End-to-end encryption, mandatory 2FA, and redundant storage, explained for the people who have to trust us with their secrets.
Envless encrypts every variable value client-side, on your device, before anything is uploaded. Your secrets are turned into ciphertext locally, so our servers store and replicate only encrypted data and never see plaintext. Connections are protected with TLS in transit, and two-factor authentication is mandatory on every account. We cannot read your values, and neither can anyone who compromises our infrastructure. This page explains exactly how that works, what we can and cannot see, and how we handle access, durability, and disclosure.
Client-side end-to-end encryption
Every variable value is encrypted on your own device, before it leaves your machine. Encryption happens in the CLI, the SDKs, and the dashboard, so what travels to us is already ciphertext. Decryption happens locally too, when you pull values or run your app. Plaintext exists only on your devices and inside your running processes, never on our servers or in our databases.
What our server can and cannot see
Our server stores ciphertext, along with metadata and the structure of your projects and environments. It can see that a variable changed, who changed it, and when, but not the value itself. We cannot read, log, or recover your plaintext secrets, and we cannot hand them to anyone, because we never hold the keys needed to decrypt them.
Mandatory two-factor authentication
Two-factor authentication is required on every Envless account, not optional. Account access always needs a second factor in addition to your password, which limits the damage from leaked or reused credentials. Combined with client-side encryption, this means a stolen password alone cannot expose your secrets. TLS protects every connection between your devices, the CLI, the SDKs, and our API in transit.
Role-based access control and audit logs
Granular role-based access control lets you decide who can read or change variables, per environment. Production can stay locked down while staging stays open to more of the team. Every change to every variable is versioned and written to a full audit log, so you can see what changed, who changed it, and when, and roll back to any previous version when you need to.
Durable, redundant storage
Your encrypted data is replicated across five independent cloud providers. If one provider has an outage or loses data, your secrets remain available and intact from the others. Because every copy is ciphertext, this redundancy adds durability without widening exposure: a compromise of any single provider still yields only encrypted data that cannot be decrypted without your keys.
Data residency and Enterprise controls
Enterprise plans add controls for organizations with stricter requirements, including EU data residency, SSO, dedicated support, and custom SLAs. If you need encrypted data stored in a specific region, or single sign-on tied to your identity provider, these are available through the Enterprise tier. Talk to us about your requirements and we will confirm what we can support before you commit.
Responsible disclosure and compliance posture
We welcome reports from security researchers and will work with you to confirm and fix valid issues quickly. If you find a vulnerability, contact us directly rather than disclosing it publicly first. Our formal compliance program is in progress, and details on our posture and any available attestations can be shared with Enterprise customers on request. We would rather under-promise here than claim a certification we do not hold.
Security FAQ
Straight answers about how Envless protects your secrets.
No. Variable values are encrypted on your device before upload, and our servers store only ciphertext. We never receive the keys needed to decrypt them, so we cannot read, log, or recover your plaintext values, and we cannot disclose them to a third party even if we were compelled to.
An attacker who reached our storage would find ciphertext, not plaintext. Without the keys held on your devices, that data cannot be decrypted. We also require two-factor authentication on every account and replicate encrypted copies across five cloud providers, so a single compromised system does not expose your secrets.
Not today. The open source SDKs and CLI are available at github.com/goenvless, but the hosted platform is not self-hostable yet. Self-hosting is something we are exploring; we will document it clearly if and when it ships, rather than imply it exists now.
We describe our compliance work as in progress rather than claiming certifications we may not hold. Enterprise customers can request details on our current security posture, controls, and any available attestations. If a specific framework matters to your purchase, contact us and we will tell you exactly where we stand.
All connections between your devices, the CLI, the SDKs, the dashboard, and our REST API use TLS. Values are also already encrypted client-side before they are sent, so data in transit is protected at two layers: the encrypted payload itself and the encrypted transport carrying it.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.