Governance

Secretsthatexpireonaschedule,notinanincident

Rotation policies with due dates, verification against the real provider, and a grace window where old and new both work.

Attach a policy to any vault secret: rotate every N days, warn before due, verify the new value against its provider before it goes live. AWS IAM keys and GCP service-account keys rotate automatically; LLM and GitHub tokens get a guided swap. Every version is kept, the previous one stays valid through a grace window, and a GitHub Action mirrors the new value into repository secrets.

Early access — turned on per workspace. Ask us to enable it for yours.

Versioned secrets with a grace window and immediate revoke
Automatic executors for AWS IAM and GCP service accounts
Provider verification before the swap: LLM, GitHub, AWS, GCP
Due and overdue notifications through Slack and signed webhooks

All features Get started

Related in Governance

Security

JWT auth, bcrypt hashing, webhook signature verification, and service-token guards.

Audit

Append-only audit events for auth, vault, integrations, triggers, and workspaces.

Budget

Monthly token budgets with hard-stop and warning thresholds, enforced pre-execution.

Approval gates

Pause any workflow at an approval node until someone signs off — or the request expires.

Sandbox

Run tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.