How we protect your keys.
Every encryption decision, every access control, every memory handling policy - documented in full. Security teams should be able to evaluate this without asking us a single question.
Encryption flow
This is the exact sequence from the moment you paste a key into the dashboard to the moment it is used to forward a request.
- 1You paste the provider key into the dashboard. It is sent to our server over TLS and encrypted there with AES-256-GCM before it is stored. It is never shown again or logged.
- 2When you create a token, the server generates a random 256-bit Data Encryption Key (DEK) and encrypts the token payload with it (AES-256-GCM): the provider key, its auth header format, the allowed hosts, endpoint scope, rate limits, cost cap and expiry.
- 3The DEK is wrapped with the master key (AES-256-GCM). The token is the version byte, nonces, wrapped DEK and encrypted payload, signed with HMAC-SHA256 under a separate HMAC key, prefixed kvt_.
- 4Your app sends the token in X-KV-Token. The edge Worker verifies the signature, unwraps the DEK, decrypts the payload in memory, then checks the request's host against the allowed hosts.
- 5If every check passes, the Worker sets the provider's auth header with the real key and forwards the request. The key is never logged.
Memory handling
Decryption happens in the Worker's V8 isolate, which is never shared with another customer's code. The Worker decrypts the token on each request.
One exception: if decryption fails transiently, the Worker can serve a key it decrypted recently in the same isolate, held only in memory (never in KV or any persistent store). Isolates are recycled frequently.
Usage records hold the org, token ID, provider, method and path, status, latency and edge location. No request bodies or auth headers. Breach events additionally record the caller's IP, attempted host, user agent and approximate location.
TLS termination
All connections to KeyVault Edge endpoints terminate TLS at Cloudflare's edge. TLS 1.2 and 1.3 are accepted; older versions are not.
HSTS is sent with a max-age of two years, includeSubDomains and the preload directive.
Connections from the edge proxy to upstream API providers (OpenAI, Stripe, GitHub, etc.) use TLS 1.2 or 1.3 with certificate verification enforced. We do not allow self-signed or expired upstream certificates.
Access model
The master and HMAC keys are set as encrypted Cloudflare Worker secrets, which can't be read back from the dashboard once set. They are not stored in the database, so database access alone does not expose plaintext keys.
Anyone able to deploy code to the Worker could, in principle, use those secrets. Deploy access to the production Worker and infrastructure is restricted to the founder's accounts.
Customer rows in the database are protected by Supabase Row Level Security; server-side administrative access uses a separate service role.
Master key management
Two root secrets exist: a 256-bit master key that wraps every token's DEK, and a separate HMAC key that signs tokens. Both are held as encrypted Worker secrets and in the dashboard's server environment, which issues tokens.
There is no cloud HSM in the current design. Rotating the master key requires re-issuing tokens, because the wrapped DEK travels inside each token.
Customer-managed keys (your own AWS KMS, GCP Cloud KMS or Azure Key Vault key) are on the Enterprise roadmap and not live yet. Enterprise customers who need to hold the keys today can run the self-hosted proxy with their own master key.
Audit logging
Every security-relevant event is written to an append-only audit log: token creation, token rotation, token revocation, key registration, key deletion, failed authentication, rate limit breach, and anomalous usage detection.
Audit logs are written to Supabase with row-level timestamps. Retention depends on your plan; see the pricing page for each plan's audit-log retention.
Org admins can export logs as JSON or CSV from the dashboard and feed them to their own SIEM. Native Splunk, Datadog and Elastic integrations are on the roadmap.
Still have questions?
Security teams running a procurement evaluation can download our pre-filled vendor questionnaire or email us directly. We respond to security@keyvaultedge.com within one business day.