Zero plaintext.
Every layer.
envfyio is built around a single constraint: no secret ever touches the application database in the clear. Encryption at rest, private networking, zero-trust access, short-lived tokens, immutable audit logs.
What we protect against
The attack surface we designed around — and the controls that mitigate each risk.
If an attacker dumps the application database, they find no secret values — all secrets are stored encrypted via Infisical's end-to-end encryption model.
Long-lived API keys committed to repos or stored in .env files are the most common secret leak vector.
A secrets API on the public internet is a target regardless of auth strength. envfyio's API is not reachable from outside the tailnet.
A compromised service should not be able to read secrets belonging to other services. Namespace isolation prevents cross-app access.
Without audit logs, it's impossible to know what was accessed and by whom. All access events are logged immutably.
Credentials that never expire accumulate risk over time. All machine identities issue short-TTL tokens with configurable max lifetimes.
Private by design — not by configuration
The secrets API has no public IP address. Access requires being on the Tailscale tailnet. The web dashboard adds a second gate via Cloudflare Access.
GitHub Actions
admin
gofyio / prod
:8080
+ CF Access
encrypted at rest
session cache
core service
✓ Cloudflare Access — identity-gated web UI
✓ TLS on every connection, even inside the tailnet
End-to-end encryption at rest
Infisical uses E2EE so that secret values are encrypted before they leave the client and can only be decrypted with the workspace key — not at the database layer.
AES-256-GCM
Secret values are encrypted with AES-256-GCM. Each workspace has a unique encryption key — never stored alongside the ciphertext.
Key hierarchy
Workspace key → secret key → ciphertext. Each layer is separately derived. Compromise of one level does not expose the full keyspace.
DB has only ciphertext
The PostgreSQL database never holds plaintext secret values. A full DB dump yields only encrypted blobs — useless without the workspace key.
TLS everywhere
All API traffic uses TLS 1.3 — including inside the tailnet. Secrets are never transmitted in the clear, even over private network segments.
Short-lived tokens, scoped access
Machine identities replace long-lived API keys. Every token has an expiry, a project scope, and a path restriction. Revocation is instant.