FAQ
Twelve answers for humans, search, and answer engines.
- Does Latchkey send my keys to the cloud?
- No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.
- How is encryption implemented?
- Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.
- Can an AI agent read every key?
- Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.
- Is there a free tier?
- No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).
- What is the leak scan?
- An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.
- How do MCP tools get a secret?
- The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.
- What does the audit log contain?
- Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.
- What is .latchkey.toml?
- A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.
- Which platforms does the CLI support?
- macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.
- How do licences work?
- After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.
- What do you never see?
- We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.
- Who do I contact for Enterprise or support?
- Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.