Enterprise Deployment Guide

Secrets & Security

Manage credentials securely across environments, from environment variables to the Rescile Vault's Zero-Knowledge system and hardware TPM support.

Edit this page on GitHub

Secrets Management & Security

Rescile provides multiple layers of secret management depending on your deployment model and security requirements.

For the built-in Rescile Vault — zero-knowledge, end-to-end encrypted secret management and pre-provisioning — see the consolidated Secrets & Vault reference. It covers the graph-native secrets architecture, the declarative Vault Synchronizer, operating the vault server and client manually, the Web UI, TPM support, batch mode, and the full vault CLI reference.

Secret Management by Deployment Model

Community Edition (rescile-ce)

Credentials for Data Generators and custom proxy apps can be resolved via environment variables. Ensure these are securely injected via your CI runner or secret manager (e.g., HashiCorp Vault, AWS Secrets Manager).

Use template expansion to pass secrets as arguments to generators rather than hardcoding them in TOML files:

[generators.discovery]
env = ["API_TOKEN={{ env.MY_SECRET_TOKEN }}"]

Enterprise Edition (rescile-portal)

In the Enterprise Edition, secrets are managed securely at the workspace level. The platform securely injects them into the execution sandbox through the same template expansion mechanism.