Self-hosted secrets

Ship secrets without shipping them.

Secria is the vault your team actually owns. Envelope-encrypted values, project-scoped access, version history, and an honest audit trail — all behind one FastAPI service and a CLI that fits your terminal.

Open the vault See how it works

AES-256-GCM: envelope encryption
100%: audited reveals
.env: push / pull / run

The shape of the vault

Four layers. One clear path.

No mystery boxes. Every secret has a home, every permission has a scope, and every change has a witness.

Workspace

Your team's top-level vault.

Project

One application, one key boundary.

Environment

Dev, staging, production, and beyond.

Secret

Versioned, encrypted, and accounted for.

Built for the way teams ship

Small surface. Hard guarantees.

Secria does one job: keep secret values out of the wrong hands and make the right hands faster.

Envelope encryption

A master key wraps one key per project. Secret values never leave the API in plaintext unless an authorized reveal asks for them.

Project-scoped access

Grant people exactly the projects and environments they need. Workspace admins see everything; members see their lane.

Every reveal is audited

Create, update, reveal, download, roll back. The log records who, when, where, and which key — never the value.

CLI-native workflow

Push a .env, pull it back, diff before you write, or run a command with secrets injected in memory. No stray files.

Sealed by default

Plaintext has one address: the API.

The web app never decrypts. The database never sees a raw secret. The master key lives outside both, and the ciphertext is bound to its exact workspace, project, environment, and key.

AES-256-GCM with a fresh nonce per version
Project keys wrapped by the master key
Reveal and download always audited

The key chain

Three locks, one direction.

A leaked database backup is not a leaked secret. Without the master key, the project keys are noise, and without a project key, the values are noise.

Master keyKEK · env only

wraps

Project keyDEK · one per project

encrypts

Secret valueAES-256-GCM

Ready when you are

Your .env deserves a better home.

Bring your workspace, your projects, and your team. Secria handles the seals, the versions, and the receipts.

Open the vault