osFoundry / Platform
Per-app secrets vault
Encrypted secrets with scheduled rotation. Masked at rest, audited on every read.
What it is
The per-app secrets vault is where the apps and backends you build inside osFoundry keep their credentials: provider API keys, database passwords, OAuth tokens, webhook signing secrets. Each app gets its own vault, so a secret used by one app is not readable by another. Values are encrypted at rest and masked when displayed, so the plaintext of a key is not sitting in a config file, a chat log, or a screenshot. Your app reads a secret by name at runtime; the raw value stays in the vault.
Rotation is scheduled rather than manual. You set a cadence for a secret, and the vault tracks when it is due, so a token you meant to cycle every 90 days does not quietly live for a year because nobody remembered it. Every read is audited: the vault records which app, and when, pulled a given secret, so if a credential leaks or misbehaves you have a trail showing where it was actually used instead of guessing.
Because osFoundry is a bring-your-own-key, local-first desktop workspace, this fits the same principle as the rest of the product: your secrets are yours, not held by a reseller. The vault sits next to your chat, agents, apps, code, and data in one workspace, so the keys your apps depend on are managed in the same place you build them rather than scattered across environment files and third-party dashboards. There are no per-seat fees for keeping secrets here.
Key capabilities
- Per-app isolation: each app gets its own vault, so one app cannot read another app's secrets
- Encrypted at rest and masked on display — plaintext keys never sit in config files, logs, or screenshots
- Scheduled rotation tracks each secret's cadence and flags when it is due, instead of relying on memory
- Audit log records which app read which secret and when, giving you a real usage trail after a leak
- Apps reference secrets by name at runtime, keeping raw values out of code and out of chat history
Use cases
- Solo builder: stores a Stripe key and a Postgres password for an app's backend, so credentials aren't hardcoded in the source
- Agent developer: rotates the provider API keys their automations depend on every quarter without hunting through env files
- Privacy-conscious team: keeps client OAuth tokens encrypted on-device and reviews the audit trail to confirm which app touched them
Frequently asked questions
Where are the secrets stored, and who can see them?
They live in your osFoundry workspace, encrypted at rest and masked when shown. osFoundry is bring-your-own-key and local-first, so your secrets are not held or resold by a third party. Each app's vault is isolated, so a secret is only readable by the app it belongs to.
How does scheduled rotation work?
You set a rotation cadence for a secret, and the vault tracks when it is due so aging tokens get cycled instead of living indefinitely. This keeps the credentials your apps and agents depend on from quietly outlasting their intended lifetime.
What does 'audited on every read' actually give me?
The vault logs each access — which app pulled which secret, and when. If a credential leaks or an app starts behaving unexpectedly, you have a record of where that secret was actually used rather than having to guess across your apps.