Security5 min read
How we encrypt your secrets
Envelope encryption with AES-256-GCM, values bound to where they belong, and a dashboard that never shows them.
A secrets manager is only as good as what happens to a value after you press Save. Here is exactly what Nionx does with it.
Envelope encryption
Every value gets its own random 256-bit data key and is encrypted with AES-256-GCM. The data key is then encrypted (“wrapped”) with a key-encryption key that never sits next to the data. What's stored is the ciphertext, the wrapped key and a few format fields: nothing that reveals the value on its own.
Bound to where it belongs
Each value is encrypted together with its context: the workspace, project, environment, secret and version it belongs to. Copy a ciphertext into another secret or environment and it won't decrypt. Change a single byte and decryption fails too.
Write-only by design
- The dashboard never shows a stored value. You can replace or revoke it, not read it.
- No person's role includes reading values. Only an API token for that environment can.
- Values never appear in logs, the audit log, error messages or API metadata.
- Rolling back to an earlier version just moves a pointer: nothing is decrypted or copied.
What's next
During the beta, keys are managed by Nionx itself. Before anyone stores real production secrets, the key-encryption key moves to a managed key service (AWS KMS), with a key rotation procedure. Until then: use Nionx for testing, not for real projects.
