security
AES-256-GCM Secrets Vault
Env vars encrypted at rest — decrypted only at deploy time, never in logs.
What you get
AES-256-GCM encryption at rest
Industry-standard symmetric encryption. Each secret is encrypted with a unique IV (initialization vector) and an authentication tag, making tampering detectable. The encryption key is stored separately from the encrypted data.
Never in logs
Secrets are injected into the build environment at deploy time and scrubbed from any log output. The Stripe key, the database URL, the API credentials — none of them appear in your deploy logs, error reports, or audit trail.
Rotate independently of code
Update a secret in the vault without changing your codebase. The rotation is applied on the next deploy. No git commits, no PR reviews, no change history in your repo for the old credential value.
How it works
- 1
Add your environment variables in Settings → Secrets.
- 2
ZipLoom encrypts each value with AES-256-GCM before writing to the database. The plaintext value is discarded from memory immediately after encryption.
- 3
At deploy time, the build environment receives the decrypted values as standard env vars.
- 4
The decrypted values are never written to disk or included in build logs.
- 5
To rotate a secret, update the value in Settings → Secrets. The old value is overwritten in the vault.
What it replaces
Doppler Team
Dedicated secrets manager, more features but separate integration
HashiCorp Vault
Self-hosted, enterprise-grade, significant operational overhead
ZipLoom (includes all features)
$99/yrRelated features