Skip to main content
  • Your data, your access. We only extract from accounts you are entitled to use, through a dedicated user you create and can revoke at any time.
  • A key per client. Every organization’s secrets are encrypted with its own AWS KMS key. Each secret is bound to the organization, platform and purpose it was stored for, and every decryption is logged.
  • Write and read are separate. The service that stores a credential cannot decrypt it. Only the extraction job that signs in can, and the login step runs before any AI agent is attached, so no model ever sees a password.
  • Deleting means deleted. When an engagement ends we disable your key and delete your rows, which makes every copy unreadable, including backups.
  • In transit and at rest. Everything is served over TLS, and exports are stored in private, encrypted buckets.