CredentialFlow sits where credentials move from issuer to recipient: the moment before SSO, MFA, and device trust take over. Split-trust encryption by default. Zero-knowledge mode available. Every delivery produces tamper-evident proof.
We observe the credential lifecycle because we have to, in order to deliver it correctly. We don't watch what happens after.
CredentialFlow exists for the bootstrap boundary before durable trust is established.
First-access trust establishment and observability: one architecture covering credential delivery to new hires and Help Desk verification before sensitive actions.
Security is our baseline, not a premium feature. Split-trust encryption, zero-knowledge mode, and tenant-level isolation aren't features we added later. They're the foundation. Every organization receives maximum-strength encryption and the same protective controls, regardless of plan.
Built for regulated industries. Available to everyone.
View 3rd Party Trust CenterSOC 2 Type II attested, covering logical access, transmission security, system monitoring, risk management, and availability. Full control mapping available under NDA.
Automatic data minimization and configurable retention policies to safeguard personal info.
ISO 27001 certification on our 2026 roadmap. Controls already aligned.
Technical controls aligned with HIPAA requirements. BAA on roadmap.
All customer data is currently hosted and processed within the United States. We are actively planning expansion to additional global regions to support our international customers' compliance needs.
CredentialFlow runs on Amazon Web Services with AWS WAF and an Application Load Balancer at the perimeter. Multi-layer rate limiting prevents brute force and enumeration. All connections use TLS 1.3. Older protocol versions are rejected at the network edge.
We deliver notifications, not secrets. Messaging providers receive routing metadata only. Secret stays encrypted in our environment until single-use retrieval.
Isolation, layered encryption, and zero-knowledge options work together so one organization's risk never becomes another's.
Each organization has unique encryption keys and a cryptographically enforced database boundary. Row-Level Security at the PostgreSQL layer ensures no application-layer bypass can expose another tenant's data.
Key shares are split between an independent vault and CredentialFlow's infrastructure. Combined only in temporary memory during use.
Client-side encryption keeps even CredentialFlow blind to the secret when compliance demands it.
Every API request passes through an independent authentication chain covering identity verification, tenant resolution, role enforcement, and resource ownership, evaluated sequentially. A bypass at any single layer cannot cross tenant boundaries.
Cryptographically signed, tamper-evident logs capture the who/what/when for each handoff, visible only to your org.
Delivery tokens are stored only as a cryptographic one-way hash. CredentialFlow cannot retrieve the original value. Multiple failed retrieval attempts trigger automatic purge before the credential can be extracted. Unclaimed secrets expire within 24 hours. Nothing lingers.
CredentialFlow offers three encryption modes:
Split-trust dual control is the foundation. BYOK uses your KMS key as one of the two shares. Zero-knowledge layers client-side encryption above the stack.
All three modes are included in every plan, and the layers compose: BYOK and zero-knowledge build on top of dual control, not around it.
Stack split-trust dual control with BYOK key sovereignty and zero-knowledge browser encryption for your strongest possible protection profile.
Separation of duties enforced at the data layer: each team operates with precisely scoped visibility.
Manage the onboarding pipeline and confirm delivery, without ever touching a credential value.
Can access
Cannot access
Provision and manage credentials while remaining blind to employee personal information.
Can access
Cannot access
Control security posture and review the complete audit trail. Credential content stays protected at the encryption layer.
Can access
Every credential lifecycle event is tracked, signed, and surfaced so your security team always has evidence, not assumptions.
From compliance teams and security reviewers. Can't find what you need? Contact us
Split-trust encryption, tamper-evident audit chains, and zero plaintext storage. Live in your environment in under five minutes.
