Security

Built so that nobody can read your keys, including us

Vallkey exists to make leaked keys harmless. That only works if Vallkey itself is the hardest place to steal one from. Here is how it is built.

Report a vulnerability

Principles

Four rules we design by

Write-only secrets

A real key goes in once and never comes out: not in the dashboard, not in the API, not for our staff.

Fail closed

A request we cannot check with certainty is refused. Unknown amounts, duplicate parameters and odd paths never pass.

Slow to loosen

Tightening is instant. Anything that opens a key up waits an hour and alerts everyone first.

Everything recorded

Every request has an outcome, and every change to keys and the team has a name and a time.

Encryption

Envelope encryption, per key

Each real key gets its own data key. The data key is wrapped by a master key that exists only in protected runtime secrets, never in storage. Master keys can be rotated without downtime, and every stored key can be re-sealed under the new one.

AES-256-GCM with a fresh random nonce for every seal
Ciphertext bound to your account, the key and its provider, so it cannot be moved
Decrypted only in memory, only while forwarding the request it belongs to

What we store, and how

Your real keys: Encrypted with AES-256-GCM under a key made for that ghost key alone, then sealed again by a master key. Never shown again.
Ghost keys and tokens: Only a fingerprint (SHA-256). We cannot show them to you again, and neither could anyone who copied our storage.
Passkeys: Only the public half. Your device keeps the private key.
Activity: Method, path, outcome, amount, status, AI tokens, and the caller's IP address, country and client. Never request bodies, query strings or other headers.

Data residency

Your data stays in the region you choose

Every account picks where its data lives when it is created. Keys, activity, the audit log, the team and the plan all follow the account.

European Union

Stored and processed only inside the European Union, enforced by our infrastructure provider's EU jurisdiction rather than by a setting we could change. Built for companies with GDPR obligations and EU customers.

Global

Stored close to where your account is used, for the fastest checks worldwide. Protected by the same encryption, contracts and safeguards as the EU region.

The region is part of every key's signed id, so each request goes straight to the right place and cannot be pointed elsewhere. Short-lived security counters (deleted within an hour), sign-in codes and the public status page are global.

Access

Who can change what, and how they prove it

The dashboard is the most powerful place in Vallkey, so it gets the strongest locks.

Phishing-resistant sign-in

Passkeys bound to our own address, so a look-alike site cannot use them. GitHub sign-in and email codes for teams that prefer them.

Roles for every person

Owners, admins and viewers. Viewers can still kill a key in an emergency, because stopping damage should never wait for permission.

Rotate without breaking

Replace a real key behind a ghost key, or replace your API token, without changing your app. Both are announced to the whole team.

Short sessions

Dashboard sessions last eight hours, live in a locked-down cookie, and end everywhere when the token is replaced.

A dashboard that cannot be framed

A strict content security policy, no tracking or analytics scripts, and every page refuses to load inside another site. The only outside code is the payment form, loaded when you upgrade.

An audit log you can export

Who did what and when, up to a year back on Team and Business. Activity per key goes back up to 90 days and exports to CSV.

Shared responsibility

While a request is forwarded, the real key is decrypted in memory for that moment only, and never written anywhere.
Vallkey fails closed: if it cannot be reached, requests stop rather than go through unchecked. Keep an offline backup key ready.
Rules limit what a leaked ghost key can do. For defense in depth, also restrict the real key at the provider.

Responsible disclosure

Found something? Email security@vallkey.com with the steps to reproduce it. We reply within two working days, keep you informed until it is fixed, and credit you if you would like. Please do not access other people's data or disrupt the service while testing.

Protect your keys with something built for it

Protect your first key in five minutes. Free plan, no card needed.

Get started Quick start guide