vault

Application-layer envelope encryption for customer secrets — AES-256-GCM, per-tenant DEK, KMS-wrapped. Audit-logged read/decrypt, zero plaintext at rest.

packages/iam/vault · Source ↗ · Docs ↗

secrets12 secrets · 3 tenants

rotation policy

OpenAI API Key

sk-•••••••••••8847

acme-prodkms/9f2arotated 3 days ago

Creem Webhook Secret

whsec_•••••••••••1c4d

acme-prodkms/9f2arotated 12 days ago

Database Password

pg://•••••••••••a31f

lumen-devkms/4b7erotated 27 days ago

PlaintextDEKKEK (KMS)

AES-256-GCM · per-tenant DEK · KMS-wrapped

In code

vault.ts

1import { getVault } from "@nebutra/vault";
2
3const vault = await getVault();
4
5// Envelope encryption — AWS KMS unwraps the DEK per-record.
6const encrypted = await vault.encrypt(secretKey, {
7  tenantId: org.id,
8  metadata: { name: "OpenAI API Key", type: "api_key" },
9});
10
11const plaintext = await vault.decrypt(encrypted);

More in nebutra.com

All 8 packages