How vaults and domain-pinned secrets work

Nairi is built so that a compromised agent cannot walk away with your credentials. There are two separate paths, depending on who needs the secret.

Placeholders, not plaintext

Secrets the agent uses go in a Vault, encrypted at the application level. The agent does not receive the value. It receives a placeholder environment variable such as CCASECRET_STRIPE_API_KEY.

A local secret proxy intercepts every outbound HTTPS request and swaps the placeholder for the real value at the last moment. It does that only when the destination is on that secret's allowed-domain list. Any other destination is blocked and logged.

So a prompt that talks the agent into sending your Stripe key somewhere else gets a placeholder, not a key.

Isolation

Agent processes run in managed containers, where the secret proxy works through a per-container MITM certificate authority. MCP servers run in their own mcp-proxy sidecar, so compromising the agent does not expose MCP credentials either. The agent can invoke the tools and nothing more.

Encryption and keys

Application-level encryption is AES-256-GCM, and everything is TLS in transit. API keys are stored hashed, and only the last four characters are ever shown back to you.

Data retention

While a subscription is active, your organisation config, transcripts and artifacts are kept indefinitely. Temporary file uploads are deleted automatically after 24 hours. After cancellation, customer data is deleted within 30 days, except where the law requires otherwise. Breaches are notified within 72 hours under the DPA.

One thing to decide for yourself

Prompts and tool output are sent to whichever model provider you selected, so read the data policy of Anthropic, OpenAI or OpenCode Zen as it applies to you. That choice is yours, not ours.