Skip to content

Connector Credential Storage and Access๐Ÿ”—

This page explains how connector credentials are stored, protected, accessed, and retired across connector configuration and runtime execution.

Overview๐Ÿ”—

At a high level:

  • Connector credentials are stored in a self-hosted HashiCorp Vault instance, so secrets stay with us.
  • Access is limited to service accounts that need credentials to run approved playbook actions.
  • End users do not retrieve raw credential values, and credentials are never logged.
  • Human access is rare and requires review plus multiple approvals.

How We Store Connector Credentials๐Ÿ”—

All connector credentials are stored in a self-hosted HashiCorp Vault instance, which provides encrypted secret storage and key management. In practical terms, secrets stay with us in a dedicated secrets manager, never as ordinary application data.

Vault encrypts and stores sensitive data with fine-grained access controls. It also maintains detailed audit logs of access and operations, supporting compliance and forensic investigations.

You can read more about Vault in the HashiCorp Vault documentation. Vault is also fully open source and auditable on GitHub.

How We Control Access๐Ÿ”—

Credentials are available only to service accounts that need them to make API calls for playbooks and automation tasks. We limit access through roles, so a service can only retrieve the secrets it is allowed to use.

  • Service accounts authenticate before they can access credentials.
  • Access is limited to the roles required to successfully run approved actions.
  • Any credential that is read is held in memory only and is never logged.
  • As soon as the credential is no longer needed, it is dereferenced and dropped from memory.
  • Human access to these roles is possible only through a review process with multiple approvals. We rarely approve this and only do so in extreme situations.

How Credentials Are Used at Runtime๐Ÿ”—

When a playbook action runs, the service retrieves the connector credential only when needed to make the required API call. The credential is used for that action, kept in memory while needed, and then dropped.

End users can view connector configuration details without seeing the underlying credential values. Raw secrets are not returned through normal UI or API reads.

Lifecycle, Logging, and Revocation๐Ÿ”—

Vault gives us a central place to manage connector credentials over time. When credentials need to be changed or removed, our services can update or revoke the relevant secrets in Vault.

Vault also records detailed logs of access and operations. In the event of a security incident, we have the necessary information to support compliance requirements.

Credentials read by service accounts are never logged. They are only held in memory for the time needed to complete the approved task.