Skip to content
PulsVaultDocs
Get started
Solo ProTeamBusinessEnterprise

Encryption & sealing

The three-layer envelope encryption model, what a database dump leaks, and the sealed-state lifecycle.

DevOps Secrets uses envelope encryption with server-side decryption. Unlike the zero-knowledge personal vault (where the server never holds keys), the DevOps engine must decrypt at runtime to serve secrets to machines — so it protects data at rest with a layered key hierarchy instead.

Three-layer key hierarchy#

text
Master key  --wraps-->  KEK (per namespace)  --wraps-->  DEK (per version)  --encrypts-->  value
   |                         |                                |                              |
outside the system     in memory only               encrypted in the DB           encrypted in the DB
  • Master key — provided at boot (environment variable now; KMS-backed later). Never persisted.
  • KEK (Key Encryption Key) — one per namespace, generated server-side, cached in memory only.
  • DEK (Data Encryption Key) — a fresh key for every write; historical versions keep their original DEK so they stay decryptable.

All layers use AES-256-GCM, with the secret's full path bound as authenticated data — which is why namespace and secret paths are immutable.

What a database dump leaks#

Honest at-rest guarantee

A stolen database contains ciphertexts, wrapped DEKs, and wrapped KEKs — but not the master key, any unwrapped KEK, or any secret value. Strong at-rest encryption with no plaintext on disk. It is not zero-knowledge: the running server can decrypt, by design.

Rotation#

  • DEK — automatic on every write. No action needed.
  • KEK — on-demand per namespace ("Rotate encryption key"). Re-wraps DEKs; values untouched; no downtime.
  • Master key — rare and sensitive; re-wraps all KEKs.

The sealed state#

If the master key isn't present at boot, the engine starts sealed:

While sealed Behavior
Browse environments, namespaces, service accounts works
Create a namespace, rotate a KEK (anything touching crypto) returns 503

The console shows a persistent "Secrets engine is sealed" banner. A platform administrator unseals it under Settings → Master key (or via the admin API) by supplying the base64 master key, which is verified against existing key material before it's accepted.

Back up the master key out-of-band

The master key is not recoverable from PulsVault. Store it securely outside the system — losing it means losing the ability to decrypt.

Was this page helpful?