- All secrets (API keys, passwords) are stored encrypted in the database; never in plain text.
- Values are NEVER shown again after saving; only a "set" state is visible and you can overwrite it.
- Credentials are decrypted only at run time, to connect to the target external system.
- Company data is isolated per company; another company can never access your credentials.
- Platform access is role-based and written to the audit log.
Do not share your secrets over insecure channels such as email; use the portal form.
