No. Secrets are never public.
Secrets always require a Vault Access Key, whether accessed via REST API or MCP.
Public does not mean an open link. It does mean the response is public material only.
It means:
Authorization: Bearer <resource public token>If a public link was enabled before this release, rotate that private key. Older links could return private key material.
No. Projects cannot be deleted.
This ensures structural integrity and audit continuity.
You can submit bugs and feature requests directly from the app in the Support section in the sidebar.
No.
Keys and certificates are immutable. If you need a new version, create a new resource.
Secrets are versioned.
When listed via vault: it may appear with "Resource expired".
When fetched directly: API returns 410 Gone.
Expired resources are not automatically deleted.
Secryn is $99 USD/year per organization. Each license covers one production environment plus one staging or test environment, with no cap on users, vaults, or resource counts. The annual subscription includes product updates made available during the active paid term and standard email support during that term. Annual renewal buys continuing updates and standard email support. The install includes the application source. Secryn is proprietary software, not an open-source product. The CLI is a separate MIT-licensed project.
A refund is available for 7 days after purchase.
You can cancel at any time. Cancellation does not revoke your license to use your installed version. Updates and standard email support continue until the end of your paid term, then end if you do not renew. You can keep using your licensed installed version forever, subject to the license terms.
You will receive:
401 Unauthorized
All API requests require authentication.
Vault Access Key:
Authorization: BearerGET and HEAD)APP_KEYPublic Resource Token:
Yes.
Secryn is fully compatible with:
Use Vault Access Keys stored in your CI secret store.
The vault access key is not a separate MCP credential. You pass it on each tool call in vault.accessKey or credentials.accessKey. The client and any model that sees the tool call can see the key. The MCP endpoint itself checks one shared instance session id in the Mcp-Session-Id header.
The MCP server rejects the request. That session id is a single value for the instance, not a per-client token.
Yes.
When using preferPublic=true, you must provide the resource-specific public token (code).
Yes.
Backup archives are encrypted with AES-256-GCM. A manual backup generates a 256-bit key shown once. Each scheduled backup uses its own key. A passphrase can be used instead; Secryn derives the AES key with PBKDF2-HMAC-SHA256 (310,000 iterations). Inside the encrypted archive, private-key files are stored as plain PEM/OpenSSH data. Secryn unwraps their SECRYN-PRIVATE-V1 envelopes at backup time, so the backup key or passphrase is what protects them, and on restore they are sealed again with the restoring instance's APP_KEY. Secret values in the database dump stay encrypted with the original APP_KEY. So does any private-key envelope Secryn could not decrypt when the backup was taken. To restore, you need the backup file, its key or passphrase, and the original APP_KEY (or the same key listed in APP_PREVIOUS_KEYS) for secret values. Treat the backup key or passphrase as sensitive as your private keys themselves: anyone who has it and the backup file can read every private key in it.
Yes. Generated private keys, uploaded private keys, and certificate private keys are stored in a SECRYN-PRIVATE-V1 envelope encrypted with APP_KEY. New files are written that way. An existing install encrypts older plaintext files with php artisan vault:encrypt-private-material (--dry-run previews the work). If APP_KEY is lost, private keys that are still only stored as that envelope cannot be recovered. A current backup stores an unwrapped copy of those keys, protected by the backup key or passphrase. Secret values, secret versions, and audit before/after values use the same APP_KEY through Laravel encryption. See Updating Secryn.
No third-party security audit or penetration test has been completed.
No.
Restore replaces the entire instance.
Request logs and MCP logs do not include secret values or private keys. Audit entries can store before and after values, and those values are encrypted with Laravel encryption keyed by APP_KEY.
No. Audit, request, user, and MCP logs are database rows. They are not hash-chained or signed. Someone with database access can change or delete them.
Yes.
All log types support CSV export.