Privacy Policy
Last updated: November 13, 2026
envpass stores environment variables for software teams. This page explains what we collect, why, and who processes it.
What we collect
Your name, email address and profile picture (from email sign-up or Google sign-in); the workspaces, projects, environments and secrets you create; and security logs: an audit trail of actions, IP addresses and user agents.
How secrets are protected
Secret values are encrypted at rest with AES-256-GCM using a separate key per project and environment. They are decrypted only to serve an authorized request and are never written to logs. Share links are encrypted in your browser and the server never receives their key.
How we use data
Only to run the service: signing you in, enforcing your team's permissions, sending sign-in codes and invitations, preventing abuse and keeping the audit log. We do not sell data or use it for advertising.
Service providers
Vercel (hosting), Neon (database), Resend (email delivery) and Google (optional sign-in) process data on our behalf.
Retention and deletion
Old secret versions are kept up to 30 per key, deleted keys for 30 days and audit entries for 90 days. Deleting a workspace removes its projects and secrets. Ask us to delete your account at any time.
Questions? Email support@envpass.dev.
Back to envpass