Encrypted environment variables for teams.
Built on battle-tested SOPS. Backend MVP live. Team features shipping.
API keys, database URLs, and tokens sitting unencrypted on every laptop. One git mistake away from a data breach.
"Hey can someone Slack me the production secrets?" Your security team just had a heart attack.
Who accessed what? When did they rotate that API key? No idea. Hope nothing breaks.
Vault is amazing... if you have a dedicated ops team. Most teams just want secrets to work.
We built a team collaboration layer on top of Mozilla SOPS.
Encrypted secrets sync via our backend. Zero plaintext on disk. Ever.
envv run decrypts in memoryWe store your secrets so teammates can sync them — but we can't read them.
Secrets are encrypted on your machine using your team's public keys, then pushed to our servers. Only team members with the matching private keys can decrypt. Private keys never leave your machine. If our servers get breached, attackers get ciphertext they can't use.
Check the code yourself. View on GitHub
Encryption happens locally. We never see plaintext.
Mozilla's proven crypto since 2015. Architecture
| SOPS | Vault | 1Password | envv | |
|---|---|---|---|---|
| Works offline | ✓ | ✗ | ✗ | ✓ |
| Team onboarding | Manual | Complex | ✓ | ✓ |
| Audit trail | ✗ | ✓ | ✓ | ✓ |
| Built for teams of | 1-2 | 20+ | Any | 3-10 |
SOPS is great. Vault is powerful. 1Password works for many teams. We're focused on the gap: teams too big for manual key management, too small for enterprise complexity.
AES-256-GCM encryption. Same crypto that protects government secrets. Built on Mozilla SOPS, trusted by thousands of companies.
Create organizations, generate age keys automatically. Role-based membership ready. Full invitation system included.
Who decrypted what secret, when? Database schema ready. Audit logging implementation in progress. SOC 2 ready architecture.
Rotate encryption keys with SOPS. Team-wide secret rotation included. Database infrastructure ready.
Airplane? VPN down? No problem. Encryption and decryption happen locally. Internet only needed for team sync.
Commit encrypted files safely. Meaningful diffs. Easy merge conflicts. Works with your existing workflow.
Works with PGP, age, AWS KMS, GCP KMS, Azure Key Vault, and HashiCorp Vault. Use what you already have.
Backend API ready for CLI. /cli/init endpoint provides SOPS config and keys. Full CLI commands in development.
Building in public. Core encryption is production-ready (it's SOPS). Team features in active development. See the code
For small teams (3-10 people) who want secrets to just work.
If you're solo or can build this yourself, you probably should.
For 3-10 people who value their time
Early Access: Free during beta. Pricing starts when team features are complete.
Have 2 people? You can probably manage with SOPS.
Have 15+? Let's talk about your needs.
We're working with 10 teams to figure out what actually matters for secret management.
Work directly with us for 3 months. Help shape the product. Pay nothing until we've earned it.
Apply for design partner program →
Join the waitlist for early access. We're onboarding design partners now.