Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is there a free tier?

No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).

What is the leak scan?

An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

← Latchkey

Security

What the software does today — not marketing claims and not an independent audit.

Threat model

Threat	Mitigation	Residual risk
Secrets at rest	libsodium secretbox (XSalsa20-Poly1305); vault holds ciphertext + nonce.	Anyone with the master key and vault file can decrypt.
Master key storage	OS keychain via keytar; optional Argon2id passphrase wrap.	Malware in the user session may access memory or keychain APIs.
Over-broad agent / tool access	.latchkey.toml allowlists; approve/deny per request; MCP needs LATCHKEY_MCP_APPROVE=1. Limits which secret names an agent can even request — not a substitute for vendor-side token scope hygiene.	A careless approve still injects plaintext into the child process; compromised tools can exfiltrate after approval.
Untrusted tool / MCP runtime	Planned: optional agent sandbox (isolated tool execution). Today: gate + audit only.	Same class of risk as agents calling third-party APIs with excessive tokens — mitigate with approvals now; sandbox later.
Logging leaks	Redaction helpers; audit log stores names and actions, not values.	External tracers can still observe child env.
Network exfiltration by CLI	CLI makes no outbound connections by default.	Commands you run may use the network.

Crypto choices

Vault values: libsodium crypto_secretbox
Master key: OS keychain (keytar) preferred
Passphrase wrap: Argon2id (crypto_pwhash)
Licences: Ed25519 signatures verified offline in the CLI

What we never see

Vault plaintext or master keys
Passphrases or keychain material
Secret values in audit sync (metadata only, if enabled)
Your repository contents during a local leak scan

Enterprise trust pack

Sub-processors, DPA summary, and procurement index: Trust & legal · Agent sandbox (M22).

Report a vulnerability

Email Yusuf@yusuf-choudhury.com with reproduction steps. Do not include real API keys.

Also see docs and packages/cli/SECURITY.md.