Security

Veil is a credential broker for agents and the humans who run them. It is in private alpha — this page is what we can already answer for, in plain terms.

Where secrets live

• Every secret is encrypted under a per-organization master key. Org masters are wrapped by a deployment key-encryption key held outside the database.
• A database dump without the KEK is ciphertext — the two are escrowed in separate failure domains.
• Items, grants, agents, and sessions are per-org. Authorization checks are org-scoped and fail closed.

What agents can see

• Agents never receive plaintext secrets — not in API responses, MCP, logs, or audit. Secrets are injected into the request/fill path.
• Grants are use-scoped and bounded: item, level, expiry, and max uses. Every use consumes a session use and writes an audit row in the same transaction — a secret never leaves unaudited.

Identity

• Humans authenticate through Ory Kratos (password + TOTP), tokens through Ory Hydra, org owner/member checks through Ory Keto. We do not hand-roll identity.
• Signup is invite-only: an owner of an existing org invites an email; the invite carries a one-time recovery code.

Operations

• Daily encrypted-at-rest dumps of every backing database, with restore drills run against real artifacts; offsite copies land in object storage on a separate failure domain.
• Audit rows are append-only, exported hourly offsite, and retained on a fixed schedule; deleting an org purges its vault data but never its audit history.
• Billing enforcement is local and fail-closed: metered use is counted per organization, plan state is confirmed by signed webhook, and a billing outage never becomes an auth outage.
• Edge and origin both terminate TLS with valid certificates (strict mode, no HTTP path).