Before you start
- Workspace owner access
Separate platform secrets from workspace secrets
Cygnetree's own database, authentication, delivery, and monitoring credentials are platform bootstrap secrets. They are provisioned by Cygnetree through Infisical and never appear as workspace integrations.
Credentials that authorize your Microsoft, Google, Resend, SMTP, storage, AI, webhook, or other provider belong to your workspace. Cygnetree does not use another workspace's credential or turn a platform feature flag into permission to access your provider.
Use the managed default
The managed vault is the zero-setup choice. Credential values are encrypted, scoped to one workspace, accepted only during setup or rotation, and never displayed again. Workspace members and support staff see the provider, purpose, health, expiry, and safe recovery state—not the secret.
New and refreshed tenant credentials are written through Cygnetree's provider-neutral secret broker using per-workspace envelope keys. During the production migration, reads prefer the workspace vault and retain a temporary compatibility read from the prior encrypted column. That legacy copy is removed only after the operator verifies the migration in every environment.
Bring an external vault
Open Settings → Secret custody. Owners and administrators can configure:
- Infisical with a project-scoped Universal Auth machine identity;
- Azure Key Vault with a least-privilege application identity;
- Doppler with a read-only service token scoped to one configuration;
- a tenant-operated 1Password Connect server and vault; or
- Bitwarden Secrets Manager through the Cygnetree tenant-agent contract.
Save the connection, enter one harmless secret reference, and choose Test without displaying. Cygnetree resolves and immediately discards the value. A successful test changes the connection from pending to connected. You can then select an existing Cygnetree logical credential and assign its external reference. From that moment, the credential fails closed if the external vault is unavailable; Cygnetree does not use the retained migration copy.
Reference formats:
| Provider | Reference |
| --- | --- |
| Infisical | /optional/folder/SECRET_NAME |
| Azure Key Vault | Secret name, plus an optional version |
| Doppler | Secret name in the configured project/config |
| 1Password Connect | item-id/field-id-or-label |
| Bitwarden tenant agent | Identifier understood by the tenant agent |
Use machine access—not a person's ordinary password vault. Workload identity remains preferred where a future supported deployment can provide it. The current hosted setup supports scoped machine credentials and tenant agents; it does not present workload identity as available.
Understand runtime access
An external vault prevents Cygnetree from persisting the business credential, but the Cygnetree service still has to resolve it briefly when it calls the provider. Cygnetree can promise that employees, support tools, logs, events, exports, and analytics cannot reveal it; a normal hosted connector cannot honestly promise that the executing service never handles plaintext.
The Bitwarden integration uses a tenant-hosted agent because Bitwarden's supported SDK/CLI performs client-side, zero-knowledge decryption. The current agent returns the resolved value to the Cygnetree operation; a later execution-agent mode can also perform the downstream provider call inside the tenant environment and return only its result. OAuth and workload identity are preferred whenever they avoid a long-lived shared secret entirely.
Rotate, revoke, and leave
Rotation creates a new version, tests it without destructive provider work, switches deliberately, and preserves safe evidence without retaining the old plaintext. A selected external vault never silently falls back to the managed vault.
Before removing a vault connection, replace every active reference. Then revoke the machine identity or token at the provider as well as disconnecting it in Cygnetree. Workspace exports omit secret values, ciphertext, machine credentials, and external secret paths.