Skip to content
CredenShare
Security

Encryption

How CredenShare encrypts and protects your shared credentials.

CredenShare uses industry-standard encryption to protect every credential you share. This page details the encryption mechanisms and security architecture.

Where encryption happens

This depends on where the share is created, and the difference matters: on one path we hold a key that could decrypt your content, and on the other we do not.

Created viaEncrypted whereCan CredenShare decrypt it?
Web appIn your browserNo — the key never reaches us
REST APIIn your clientNo — the API refuses plaintext
Official SDKsIn your processNo — the client encrypts before the request
Slack appOn our serversYes — the credential passes through Slack first

Web and API shares

A content key is generated in the client and used to encrypt your fields with AES-256-GCM before anything is sent. That key travels in the share link's URL fragment, which browsers never transmit to a server. What we store is ciphertext plus a hash of an access token, so we can serve the share to whoever holds the link without being able to read it.

The API enforces this rather than merely encouraging it: a create must declare e2ee-aes256-gcm and supply ciphertext, and a plaintext value is rejected. See client-side encryption for the exact wire format.

Every share gets its own content key, so exposing one link cannot decrypt any other share. The consequence is that losing the link loses the content — nobody, including us, can recover it.

Slack shares

A credential sent through the Slack app has already passed through Slack before it reaches us, so client-side encryption buys nothing. These are encrypted on our servers with AES-256 envelope encryption, using a customer-managed key in AWS KMS. We can decrypt them; we say so plainly rather than implying otherwise.

Encryption at rest

ComponentAlgorithmKey management
Client-encrypted contentAES-256-GCMKey held only by the link holder
Server-encrypted contentAES-256 envelope encryptionCustomer-managed key in AWS KMS
Database fieldsAES-256Managed database encryption

Encryption in Transit

All connections to CredenShare use TLS 1.2+:

  • API endpoints: HTTPS required (HTTP redirected)
  • Web application: HSTS enabled
  • Internal calls: our functions authenticate to AWS services with scoped IAM roles

Key Management

For shares created from the web, the REST API or an SDK there is no server-side key. The content key is generated in the client and never reaches us, so there is nothing for us to hold, rotate or hand over.

Server-encrypted (Slack) shares use envelope encryption: a new data key is generated for every encryption operation, and the master key that wraps it is customer-managed in AWS KMS.

Data Lifecycle

Client-encrypted shares — web, REST API and SDKs

Encrypt in client → Store ciphertext → Serve ciphertext → Decrypt in browser → Delete
  1. Encrypt: the client generates a content key and encrypts the fields
  2. Store: we store the ciphertext plus a hash of an access token
  3. Serve: we return the ciphertext to whoever presents the link
  4. Decrypt: the recipient's browser decrypts using the key in the URL fragment
  5. Delete: at expiration the ciphertext is deleted

Server-encrypted (Slack) shares

Create → Encrypt → Store → Access → Decrypt → Display → Delete
  1. Create: the credential arrives from the Slack dialog
  2. Encrypt: the server encrypts it with a per-share data key wrapped by KMS
  3. Store: the encrypted credential is saved to the database
  4. Access: the recipient visits the share URL
  5. Decrypt: the server asks KMS to unwrap the data key
  6. Display: the plaintext credential is shown to the recipient
  7. Delete: once expired or consumed, the encrypted data is deleted
Expired credential ciphertext is deleted from the live database within an hour. Database backups roll off on their own retention schedule — 7 days in production.