Storing other people's secrets is the highest-trust ask in software. Here is exactly what we do with yours, and where the limits are.
Encryption at rest. Secret values are encrypted at rest on the platform. They are decrypted in memory only when you open a viewer, and the plaintext is discarded when the viewer closes. A value never sits in a long-lived store.
Masked by default. Values render as bullets everywhere: tables, diffs, history. Reveal is click-only, never hover, so shoulder-surfers and tooltip previews get nothing. Copy is a separate, deliberate action.
Clipboard hygiene. Copied secrets clear from the clipboard after 30 seconds. Nothing lingers to be pasted into the wrong chat window.
Audit everything. Every read and write lands in the audit log: who, when, what changed, from where. Reveal and copy count as read events. Values never appear in the records themselves, and error responses are scanned for leakage before they render.
Access control on every route. Membership is checked on every API route and every page. There is no unauthenticated path to a value, and every mutation path (UI, import, rollback, sync) writes its audit entry.
The database is encrypted at rest by the hosting platform. We do not do our own envelope encryption yet, which means anyone with the project's service_role key (and the platform operator) can read values. Masking is a display rule, not encryption. Per-project keys are the documented upgrade path, and they will ship before any claim otherwise.
Old versions and audit events are deleted after 90 days by a nightly purge; the current state is never touched. Deleting a project deletes everything with it. There is no backup of deleted secrets anywhere in v1.
Saying the limit out loud builds more trust than a badge wall.