Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is there a free tier?

No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).

What is the leak scan?

An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

Pricing

Simple tiers

No free tier. Pro is the default for multi-repo and MCP workflows; Solo is one device. Unbuilt features show Coming soon and are never sold as ready.

Solo

£4.99/mo

One machine, a few scoped projects.

· 1 device
· 1 vault
· Up to 3 scoped projects
· Local audit log
· CLI + daemon
· Agent approval prompts

Email for licence

Pro

£15/mo

Daily flow across repos and agents.

· 3 devices
· 2 vaults
· Up to 15 scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon

Email for licence

Team

£60/mo

Higher limits for a small group. Shared workspace & invites are in build — licence capacity ships today.

· 10 devices
· 5 vaults
· Unlimited scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon
· Team workspace in the app
· Team sharing & invites In build

Email for licence

Checkout unlocks Team device and vault limits on your licence today. Team sharing, invites, and org features marked “In build” ship later — no surprise upsell; see roadmap.

Business

£124/mo

Higher local capacity and hardened policy.

· 25 devices
· 10 vaults
· Unlimited scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon
· Hardened policy (approve every access)
· Priority email support — 1 business day (Yusuf@yusuf-choudhury.com)
· SSO (SAML) In build
· Org-wide policy templates In build

Email for licence

Checkout unlocks Business device and vault limits on your licence today. Team sharing, invites, and org features marked “In build” ship later — no surprise upsell; see roadmap.

Leak scan

£2.99 one-off

One local repo or paste scan for exposed keys, with rotation guidance.

· latchkey scan (offline)
· Heuristic pattern pass
· Redacted terminal preview
· Step-by-step rotation guidance
· One purchase per email & device

Receipt email (one scan per email & device)

Enterprise

Custom terms, procurement, and deployment questions.

Book a call

Who each tier is for

B2C is self-serve checkout. Team and Business bridge to sales-led Enterprise when procurement appears.

solo — Individual dev
When: First agent or side project with real API keys
Path: Home → tour → £4.99 checkout → success → CLI → dashboard preview
Upsell: Pro when you need 2+ vaults or daily MCP
pro — Daily driver
When: Cursor/Claude every day, multiple repos
Path: Pricing Pro card → checkout → latchkey run + MCP approve
Upsell: Team when sharing billing with cofounders
team — Small squad (2–10)
When: Shared agent policy, more devices
Path: Team tier + /app team preview → invites when shipped
Upsell: Business for hardened approve-every-access
business — Lead eng / security-conscious startup
When: Procurement asks questions, SSO on horizon
Path: Business checkout or contact for MSA → trust pack
Upsell: Enterprise custom + design partner (E4)
Leak scan — Top-of-funnel
When: Leaked key scare, blog post, GitHub panic
Path: £2.99 one-off → rotation guidance → Pro for ongoing gate
Upsell: Pro within 7 days of scan (email nudge — manual for now)
enterprise — Global / regulated
When: Agent rollout at scale, vendor review
Path: Contact → procurement one-pager → pilot → MSA (E3) → SSO (E2)
Upsell: Seat expansion + Latch Check / sandbox when live

Design partners: /trust/partners

Roadmap (not sold until shipped): Team sharing & invites · SSO (SAML) · Org-wide policy templates · Hosted audit export

Simple tiers

No free tier. Pro is the default for multi-repo and MCP workflows; Solo is one device. Unbuilt features show Coming soon and are never sold as ready.

Solo

£4.99/mo

One machine, a few scoped projects.

· 1 device
· 1 vault
· Up to 3 scoped projects
· Local audit log
· CLI + daemon
· Agent approval prompts

Email for licence

Pro

£15/mo

Daily flow across repos and agents.

· 3 devices
· 2 vaults
· Up to 15 scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon

Email for licence

Team

£60/mo

Higher limits for a small group. Shared workspace & invites are in build — licence capacity ships today.

· 10 devices
· 5 vaults
· Unlimited scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon
· Team workspace in the app
· Team sharing & invites In build

Email for licence

Checkout unlocks Team device and vault limits on your licence today. Team sharing, invites, and org features marked “In build” ship later — no surprise upsell; see roadmap.

Business

£124/mo

Higher local capacity and hardened policy.

· 25 devices
· 10 vaults
· Unlimited scoped projects
· Local audit log
· MCP approval mode
· CLI + daemon
· Hardened policy (approve every access)
· Priority email support — 1 business day (Yusuf@yusuf-choudhury.com)
· SSO (SAML) In build
· Org-wide policy templates In build

Email for licence

Checkout unlocks Business device and vault limits on your licence today. Team sharing, invites, and org features marked “In build” ship later — no surprise upsell; see roadmap.

Leak scan

£2.99 one-off

One local repo or paste scan for exposed keys, with rotation guidance.

· latchkey scan (offline)
· Heuristic pattern pass
· Redacted terminal preview
· Step-by-step rotation guidance
· One purchase per email & device

Receipt email (one scan per email & device)

Enterprise

Custom terms, procurement, and deployment questions.

Book a call

Who each tier is for

B2C is self-serve checkout. Team and Business bridge to sales-led Enterprise when procurement appears.

solo — Individual dev
When: First agent or side project with real API keys
Path: Home → tour → £4.99 checkout → success → CLI → dashboard preview
Upsell: Pro when you need 2+ vaults or daily MCP
pro — Daily driver
When: Cursor/Claude every day, multiple repos
Path: Pricing Pro card → checkout → latchkey run + MCP approve
Upsell: Team when sharing billing with cofounders
team — Small squad (2–10)
When: Shared agent policy, more devices
Path: Team tier + /app team preview → invites when shipped
Upsell: Business for hardened approve-every-access
business — Lead eng / security-conscious startup
When: Procurement asks questions, SSO on horizon
Path: Business checkout or contact for MSA → trust pack
Upsell: Enterprise custom + design partner (E4)
Leak scan — Top-of-funnel
When: Leaked key scare, blog post, GitHub panic
Path: £2.99 one-off → rotation guidance → Pro for ongoing gate
Upsell: Pro within 7 days of scan (email nudge — manual for now)
enterprise — Global / regulated
When: Agent rollout at scale, vendor review
Path: Contact → procurement one-pager → pilot → MSA (E3) → SSO (E2)
Upsell: Seat expansion + Latch Check / sandbox when live

Design partners: /trust/partners

Roadmap (not sold until shipped): Team sharing & invites · SSO (SAML) · Org-wide policy templates · Hosted audit export