Security
Defense in depth, by construction
Every design decision favors boundaries over convenience — so a compromise in one layer does not become a compromise in the next.
Zero-knowledge portal
The portal is a stateless BFF — it holds no database, no secrets, and no key material. All sensitive operations are proxied to backend services over authenticated channels.
Envelope encryption
Each secret is encrypted with its own Data Encryption Key (DEK). The DEK is wrapped by a Key Encryption Key (KEK) in the KMS. Compromising one secret does not expose any other.
Non-exportable root keys
The KMS root key never leaves the service boundary. KEKs are stored wrapped at rest and can only be unwrapped inside the KMS process. Rotation is admin-gated and fully audited.
Blind index
Secret names are never stored in plaintext. A keyed HMAC produces a deterministic blind index that allows lookup without disclosure — names never appear in URLs, logs, or audit trails.
Ephemeral credentials
Actionsets like pgsql mint short-lived database roles with
VALID UNTIL and clean them up on expiry or explicit delete. No
credential outlives its usefulness.
Full audit trail
Every decrypt, rotation, and expiry is recorded with the caller's identity, timestamp, and context. Secret version history tracks who rotated what and when — old values are never stored.
The boundaries
Four services, three databases, one root key. Nothing that matters shares a process with the thing presenting it.