Secryn is self-hosted software. This page describes the current application behavior. It is not a third-party audit report, and Secryn has not completed a penetration test.
Secret values and secret versions are encrypted with Laravel encryption keyed by APP_KEY before they are stored. Audit log before and after values use the same encryption.
APP_KEY is a single application key in the instance .env. Secryn does not wrap it with per-vault data keys, a KMS, or an HSM. Anyone who has the ciphertext and APP_KEY can decrypt those values. Protect .env with the same care as the vault contents. A restore on another host can read existing secret values with the original APP_KEY, or with the same key listed in APP_PREVIOUS_KEYS. Losing APP_KEY makes private keys that are still only stored as SECRYN-PRIVATE-V1 envelopes unrecoverable.
Generated private keys, uploaded private keys, and certificate private keys are files encrypted with APP_KEY in a SECRYN-PRIVATE-V1 envelope. New files are written that way. Files created before this encryption shipped stay in the older plaintext form until an existing install runs php artisan vault:encrypt-private-material. The command supports --dry-run. Steps for that upgrade are in Updating Secryn.
There is no separate key hierarchy, KMS, or HSM. If APP_KEY is lost, private keys in that envelope cannot be recovered.
A public link returns only public material. It never returns a private key. A vault access key can still read the private key for that vault. Anyone who fetched a public link before this change may already have the private key, so rotate any private key whose public link was ever enabled on an older release.
Each vault has one access key. Clients send it as Authorization: Bearer <vault access key>. Query parameters such as include, resource, and secrets choose what the response contains. They are not credentials. The API does not accept the access key as a query parameter.
The key is scoped to that one vault. It does not inherit a user role, and project RBAC or restricted-vault membership does not narrow it. Routes that accept it allow GET and HEAD only, so the key can read that vault's secrets (including values), keys, and certificates, and it cannot create or update resources through those routes.
Secryn stores the access key as an HMAC-SHA256 hash keyed by APP_KEY. A legacy plaintext access_key column is still accepted when a row still has a value in it. The raw key is shown once when it is created or rotated. Rotation can keep the previous key for a configured grace period. The default grace period is none.
Backup archives are encrypted with AES-256-GCM. A manual backup generates a 256-bit key and shows it once. Each scheduled backup uses its own key. You can also protect a backup with a passphrase. Secryn derives that AES key with PBKDF2-HMAC-SHA256 (310,000 iterations). The generated key remains available from Recent Operations for about 24 hours. Store it outside Secryn.
The archive holds the database dump plus the on-disk key and certificate files. Inside the encrypted archive, private-key files are stored as plain PEM/OpenSSH data. Secryn unwraps their SECRYN-PRIVATE-V1 envelopes at backup time, so the backup key or passphrase is what protects them, and on restore they are sealed again with the restoring instance's APP_KEY. Secret values in the database dump stay encrypted with the original APP_KEY. So does any private-key envelope Secryn could not decrypt when the backup was taken. To restore, you need the backup file, its key or passphrase, and the original APP_KEY (or the same key listed in APP_PREVIOUS_KEYS) for secret values. Treat the backup key or passphrase as sensitive as your private keys themselves: anyone who has it and the backup file can read every private key in it.
The MCP endpoint checks one shared instance session id, sent in the Mcp-Session-Id header. There is no per-client MCP token. Vault access keys are supplied inside the tool call, in vault.accessKey or credentials.accessKey. The MCP client, and any model that sees the tool call, can see that key.
Audit, request, user, and MCP logs are database rows. They are timestamped in UTC. They are not hash-chained, signed, or otherwise tamper-evident, and someone with database access can change or delete them. Request logs do not store secret values. Audit before and after values are encrypted with Laravel encryption keyed by APP_KEY.
The self-hosted install includes the application source so you can run Secryn. That is not an open-source license. Secryn is $99 USD per year per organization. A refund is available for 7 days after purchase. The license is the agreement that applies.