Configuration that is write-only and never touches the disk
Environment variables are encrypted at rest under a key that lives outside the database, returned by no endpoint, scrubbed out of build logs, and handed to Docker through the environment of one process rather than written into any file.
What you get
Encrypted at rest
Values are stored AES-256-GCM encrypted under a key kept outside the database. A copy of the database alone reveals nothing.
Secrets stay secret
Every variable is a secret unless you declare it plain configuration. A configuration value can be read back, and the read is audited; a secret can never be read back at all.
Shared variable sets
Define a set once and attach it to the applications that need it, instead of pasting the same keys into each.
Find any key
The organization-wide view answers “where does this key appear?” across every application and set, searching keys and notes — never values.
In detail
- Import a .env file: it is parsed in your browser and you confirm each line’s kind before anything is saved.
- Values are scrubbed out of build logs at the single point every line passes through.
- No response schema has a field that could carry a plaintext value — the list shows keys, kinds, notes, and value lengths.
- Values reach your containers through the environment of the Compose process, never through a file on disk.
Works well with
Git deployments
Push to your branch and it ships itself — built, health-gated, and rollback-ready.
Managed databases
One-click PostgreSQL, Redis, and MinIO with scheduled backups.
Teams and security
Organizations, roles, passkeys, two-factor, API tokens, and an audit log.
Your server is ready when you are
Create an account, connect a VPS, and ship your first application.