Secrets management
that developers trust.
Push, pull, and inject secrets with Git-like commands. No plaintext files. No sync conflicts. Just encrypted secrets, delivered in-memory.
Set Up Your Workspace
Map your directory to a secure project environment.
Authenticate local CLI
Secure login flow via browser OAuth
Link project workspace
Maps enclave://project-id to current directory
Create encrypted config
Saves verified workspace metadata locally
Envelope Encryption
AES-256-GCM at rest
Version History
Immutable audit trail
Team Collaboration
Up to 5 members per project
CLI-First
Git-like developer workflow
How It Works
Three commands. Zero friction.
Link your workspace
Run enc init in your project root. Enclave maps your directory to a secure project environment using an encrypted local config.
Inject at runtime
Use enc run to start your app with secrets loaded directly into process memory. No .env file ever touches disk.
Stay in sync
Fast-forward checks prevent overwrite conflicts. If a teammate pushed changes, Enclave blocks until you pull the latest.
Features
Built for speed. Engineered for safety.
Everything you need to secure your team's config without the friction of legacy vault platforms.
Git-like commands
No new paradigms. Manage environments and versions using push, pull, and revert — the workflow you already know.
Envelope encryption
Every secret encrypted at rest with AES-256-GCM. Projects use isolated data keys managed by the server architecture.
Immutable versions
Every push creates a new version. View history, diff changes, and roll back to any previous point in time.
Audit logging
Complete tamper-proof trails tracking who created, accessed, modified, or reverted any secret across the team.
FAQ
Common questions.
What is Enclave?
Enclave is a secure, lightweight secrets management platform for developer teams. It provides Git-like commands to push, pull, and inject secrets securely into application memory, eliminating plaintext .env file vulnerability across team members.
How does Enclave secure my secrets?
Enclave secures secrets using AES-256-GCM envelope encryption at rest. Every secret version is encrypted with a unique data key generated per project, ensuring that secret values are completely isolated and stored encrypted in the database.
How does the Enclave CLI work?
The Enclave CLI links your local workspace to an active project environment. Commands like pull download and format secrets into local environment files, while run fetches secrets dynamically into memory, executing your processes securely without file-based exposure.
How does Enclave prevent sync conflicts?
Enclave prevents concurrent overwrites using a fast-forward verification check. When a developer pushes secrets, the CLI checks the timestamp of the last local pull against the server version. If updates have occurred, the push is rejected until the developer runs pull.
Start securing your secrets.
Install the CLI in seconds. No account required to explore.