Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is there a free tier?

No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).

What is the leak scan?

An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

← Latchkey

Changelog

Notable product and site changes. We do not publish usage statistics or customer counts here.

2026-10-10
M22-cli + E2–E4 + B2C tier guide
CLI latchkey run --sandbox preview flag. Trust pages: SSO, MSA/invoicing, design partners. Pricing: who each tier is for.
2026-10-10
E1 complete + M22 sandbox + M23 dashboard v2
Trust: security overview, procurement one-pager, SOC 2 status. M22: /agent-sandbox and dashboard card. M23: CLI status strip, quick actions, dashboard layout refresh.
2026-10-10
Waitlists on home + Latch Agent / Latch Check
Home #coming-soon section; /latch-agent and /latch-check waitlists; /roadmap explains M14–M21; Compare in header nav; /agent-check redirects to Latch Check.
2026-10-10
M14–M21 + E1 trust pack
Compare page and tier matrix; ecosystem strip; Agent Check and VibeCheck waitlists; Human/AI reader mode with llms.txt banner; route loader; FAQ-powered Ask Latch; Trust hub with sub-processors and DPA summary; dashboard and app Latch in top bar (M10–M13 batch).
2026-10-09
SaaS marketing pages
Added About, Privacy, Terms, Changelog, Blog, and related navigation under the modexventures.com/latchkey canonical base. Pricing and plan copy remain tied to live Stripe products in GBP.
2026-09-28
Licence hardening
Ed25519-signed licence tokens (latchkey.v1) with documented rotation steps. Entitlement checks on the web app use Supabase-backed records; vault contents remain local-only.
2026-09-15
Modex Ventures rebrand
Product positioning under Modex Ventures with updated site theme (teal accent, local-first messaging) and footer/legal links. CLI security notes published in packages/cli/SECURITY.md.

← Latchkey

Changelog

Notable product and site changes. We do not publish usage statistics or customer counts here.

2026-10-10
M22-cli + E2–E4 + B2C tier guide
CLI latchkey run --sandbox preview flag. Trust pages: SSO, MSA/invoicing, design partners. Pricing: who each tier is for.
2026-10-10
E1 complete + M22 sandbox + M23 dashboard v2
Trust: security overview, procurement one-pager, SOC 2 status. M22: /agent-sandbox and dashboard card. M23: CLI status strip, quick actions, dashboard layout refresh.
2026-10-10
Waitlists on home + Latch Agent / Latch Check
Home #coming-soon section; /latch-agent and /latch-check waitlists; /roadmap explains M14–M21; Compare in header nav; /agent-check redirects to Latch Check.
2026-10-10
M14–M21 + E1 trust pack
Compare page and tier matrix; ecosystem strip; Agent Check and VibeCheck waitlists; Human/AI reader mode with llms.txt banner; route loader; FAQ-powered Ask Latch; Trust hub with sub-processors and DPA summary; dashboard and app Latch in top bar (M10–M13 batch).
2026-10-09
SaaS marketing pages
Added About, Privacy, Terms, Changelog, Blog, and related navigation under the modexventures.com/latchkey canonical base. Pricing and plan copy remain tied to live Stripe products in GBP.
2026-09-28
Licence hardening
Ed25519-signed licence tokens (latchkey.v1) with documented rotation steps. Entitlement checks on the web app use Supabase-backed records; vault contents remain local-only.
2026-09-15
Modex Ventures rebrand
Product positioning under Modex Ventures with updated site theme (teal accent, local-first messaging) and footer/legal links. CLI security notes published in packages/cli/SECURITY.md.

M22-cli + E2–E4 + B2C tier guide

E1 complete + M22 sandbox + M23 dashboard v2

Waitlists on home + Latch Agent / Latch Check

M14–M21 + E1 trust pack

SaaS marketing pages

Licence hardening

Modex Ventures rebrand