Security

How your signing keys, secrets, and credentials are protected.

Your signing key is yours

bedrock never generates or takes ownership of a keystore. You upload one you already control, it's encrypted the moment it arrives, and it's only ever decrypted, briefly, to sign a build. It's never stored or logged in plaintext. Your signing identity stays portable; it isn't locked into bedrock.

Encrypted at rest, decrypted only when needed

Keystores and secret environment variables are encrypted before they're stored. Decryption only happens for the moment a build actually needs the value, inside an isolated, single-use build environment that's discarded the moment the build finishes. Nothing decrypted ever touches long-term storage or a log file.

Secrets are write-only

Once you set a secret value, no API or dashboard view ever shows it again. It's the same convention GitHub Actions secrets use. You can rotate or delete a secret, but you can't retrieve one you've already set. Secret values are also redacted from build logs, so a command that accidentally prints one doesn't leak it into your build history.

Your login credential

Signing in issues a dedicated, long-lived credential for the CLI, not a raw browser session token. It's stored hashed on our side, never in plaintext, and the local copy on your machine is saved with restrictive file permissions.

Strict access boundaries

Every request is checked against the full chain of ownership: organization, project, app, before it's allowed through. Belonging to one organization never gives you access to another organization's apps, builds, or secrets, even by guessing an ID.

Time-limited access to build artifacts

Links to download a build's source or artifact are scoped to exactly that one file and expire after a short window. They aren't permanent, reusable links. Source code uploaded for a build is automatically deleted a short time after the build finishes; bedrock doesn't retain a copy of your repository.