Plaintext stays in the enclave
Keys are decrypted only inside isolated workers (AWS Nitro Enclaves or GCP Confidential VMs), held for under 5 seconds, then zeroed.
Overlap rotation · verify before revoke
Key rotation,
kept on the record.
KeyPilot rotates third-party and cloud API keys on schedule, pushes them to where your apps read secrets, verifies them live, then revokes the old key. No human ever sees or copies one.
rot_8f2astripe-live-keycreating new key at provider
- GitHub Actions
- GitLab CI
- Bitbucket
- Vercel
- Netlify
- Render
- Fly.io
- Heroku
- AWS Secrets Manager
The problem
Policy says rotate every 30 to 90 days. The manual way makes every rotation a leak.
- Log in to the provider dashboard
- Generate a new key
- Copy itclipboard
- Paste it into several secret storesSlack, screenshots
- Redeploy
- Remember to revoke the old one
Cloud tools rotate database and cloud credentials. Most third-party APIs, from payments to email, AI and telephony, have no automated rotation at all.
How rotation works
Create, push, verify, revoke. In that order, every time.
- 01
Create
A fresh key is minted at the provider while the old one keeps serving traffic.
- 02
Push
The new key goes straight to every bound destination. No clipboard, no Slack, no human.
- 03
Verify
A live call proves the new key works. App health checks must stay green.
- 04
Revoke
Only then is the old key revoked. Any failure rolls back automatically.
$ keypilot rotate stripe-live-key --wait → creating new key at provider
Integrations
Rotates at the provider. Delivers where your apps already read secrets.
Providers with a key-management API get native connectors. Providers without one get browser-automation connectors that run in the secure zone, and they are labelled as such. Anything else: build it with the Connector SDK.
Connects with
Payments
- Stripe
- Adyen
- PayPal
- Square
- Braintree
AI
- OpenAI
- Anthropic
- Google Gemini
- Cohere
- Mistral
Messaging
- Twilio
- SendGrid
- Mailgun
- Postmark
- Vonage
- Slack apps
Cloud
- AWS IAM
- GCP service accounts
- Azure app secrets
- Cloudflare
- DigitalOcean
Dev tools
- GitHub
- GitLab
- npm
- Docker Hub
- Datadog
- Sentry
- PagerDuty
Data
- MongoDB Atlas
- Snowflake
- Supabase
- PlanetScale
- Algolia
- Elastic
Business SaaS
- HubSpot
- Salesforce
- Shopify
- Zendesk
- Intercom
Destinations
- GitHub Actions
- GitLab CI
- Bitbucket
- Vercel
- Netlify
- Render
- Fly.io
- Heroku
- AWS Secrets Manager
- GCP Secret Manager
- Azure Key Vault
- Kubernetes
- Doppler
- 1Password
- HashiCorp Vault
- .env via agent
Leak response
A leaked key is replaced before anyone finishes reading the alert.
Leak signals arrive from GitHub's secret scanning partner program, GitGuardian, and KeyPilot's own public-repo and paste-site scanner. Each signal is confirmed with the provider, then the key is rotated. Our design target: revoked and replaced within 60 seconds of detection.
Rotate first, ask laterOptional mode for confirmed leaks. Approvals happen after the key is already dead.
Approvals and audit
Approve from your phone. Hand the auditor a file.
- Approvals on iOS, Android, Slack and Microsoft Teams, bound to one rotation and expiring in 15 minutes
- SSO with SAML or OIDC, SCIM provisioning, roles, and break-glass access that requires a written reason
- Hash-chained audit log, mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls; export to PDF, CSV, Splunk, Datadog or Sentinel
audit.logexample
09:00:02policystripe-live-key due · 30-day interval
09:00:03approvalrequested from security-leads
09:02:41approvalgranted via passkey
09:02:44createkey_v14 created at provider
09:02:47pushGitHub Actions, Vercel, AWS Secrets Manager
09:02:52verifylive call ok · health checks green
09:03:10revokekey_v13 revoked
Security
Designed on the assumption that our own control plane gets breached.
Envelope encryption per tenant
Each tenant has its own key-encryption key in a cloud HSM. Every secret gets its own AES-256-GCM data key.
Bring or hold your own key
Enterprise tenants can supply their KEK and revoke our access at any time, making their data unreadable to us.
Nothing kept long-term
A rotated key is kept only for the rollback window (24 hours by default), then destroyed. Your secret store stays the record.
Least-privilege credentials
Provider credentials are scoped to key management where possible, with a visible scope score and warnings.
Keys inside your network
The self-hosted agent creates and pushes keys locally and sends only key ID, fingerprint and status to the cloud.
Multi-tenant SaaS · US and EUSingle-tenant dedicated cloudFully self-hosted
Stop scheduling key rotations on a calendar.
Connect one provider and one secret store. Watch the first rotation run, start to finish.