Security

Plain English, no jargon — the sort of detail a Cyber Essentials assessor or a security-conscious client will ask for.

Secrets are encrypted, and destroyed on view

Every secret is encrypted with AES-256-GCM — authenticated encryption, so a payload can't be tampered with undetected. A one-time secret is hard-deleted the moment it's viewed (or when it expires): the ciphertext is gone, not just hidden. There is nothing left to leak.

We keep metadata, never your secret

The audit trail records who sent what, to whom, and when — sender, recipient label, timestamps, viewing IP and user agent, verification status. It never stores the secret's content, the decryption material, or any attachment content. Even we can't read your secrets from the audit log, because they were never written to it — that's a statement about the audit trail, not about the service as a whole. The next section explains exactly where SecretWolf does and doesn't hold your encryption material.

How this compares to zero-knowledge tools

Some one-time secret tools encrypt in the browser, so the key never reaches their server. SecretWolf doesn't work that way: your secret is encrypted with AES-256-GCM before it's stored, and SecretWolf holds the encryption material for as long as the secret is live. That's a real difference and worth being clear about.

What it buys you is everything a zero-knowledge tool structurally cannot do: serving links from your own brand and domain, requesting secrets inbound from a client, verifying a recipient's email before the secret reveals, scanning attachments for malware, and keeping an audit trail your client's security review will accept. If browser-side encryption with no server-held key is a hard requirement for you, a self-hosted tool like PrivateBin is the better fit, and we'd rather say so.

Recipient verification

For sensitive handovers you can require the recipient to prove control of their email with a 6-digit one-time code (10-minute expiry, rate-limited) before the secret will reveal. Passwords for your team are stored with PBKDF2, never in the clear.

How your team signs in

By default a SecretWolf account is an email address and a password stored with PBKDF2, and a workspace can require an authenticator app for everyone in it. On the Business plan you can hand authentication to your own identity provider instead: single sign-on over OpenID Connect, with Microsoft Entra ID or Google Workspace. Sign-in then happens at your provider — SecretWolf never sees the password — and your provider's own multi-factor and conditional-access policies apply. That's why an SSO session isn't also asked for a SecretWolf authenticator code: the second factor has already been proved, by you.

An owner can make single sign-on the only way members sign in. Owners always keep a password route, and that's deliberate: an expired client secret or a misconfigured application at your identity provider must never be able to lock a workspace out of its own audit trail. Two limits are worth stating plainly. It's OpenID Connect only — there is no SAML option. And there is no SCIM: nothing is synced from your directory, so disabling someone at your provider stops them signing in through it, but their SecretWolf account remains until an owner removes it. The full picture is on single sign-on.

Attachments

Files are capped at 10 MB, restricted by extension and type, scanned for malware before storage, encrypted at rest, and removed on the same delete-on-view rules as the secret they belong to.

Isolation between customers

Every customer workspace is isolated at the data layer — a workspace can only ever see its own secrets, requests and audit records. That isolation is enforced centrally and verified by an automated test suite on every change.

Hosting

SecretWolf runs on UK infrastructure over HTTPS end to end, with a strict content-security policy, HSTS, and per-endpoint rate limiting on everything public. Custom domains get automatic TLS certificates.

Responsible disclosure

Found something? Tell us through the contact form and we'll work with you. Automated tooling can find the same route in security.txt.

Where to next

See how this security model applies to your work — for agencies, MSPs and accountants — read our compliance summary and who's behind SecretWolf, or compare the plans and their limits on the pricing page.