System Architecture Overview

RunEnv separates configuration management, authorization, storage, and runtime delivery into explicit application boundaries.

Platform Architecture

RunEnv uses a control-plane API and supported client integrations with explicit authentication and authorization boundaries.

  • The Control Plane (Dashboard & API): Where administrators configure projects, environments, RBAC policies, and enterprise features (Transit Engine, Dynamic Secrets).
  • Runtime delivery path: Authenticated API routes resolve authorized values for a selected project and environment.
  • Client Integrations (CLI & SDKs): The tools installed in your infrastructure communicate with the RunEnv API to fetch or inject authorized values at runtime.

Data Storage & Encryption

RunEnv uses a robust database layer (PostgreSQL via Prisma ORM) to store configuration, users, and encrypted secrets.

Envelope Encryption

RunEnv utilizes an Envelope Encryption architecture.

  1. Your secrets are encrypted using a Data Encryption Key (DEK).
  2. The DEK is then encrypted using a Master Key (KEK - Key Encryption Key) managed by a robust KMS (like AWS KMS or Google Cloud KMS).
  3. We use libsodium (AES-256-GCM) for all data encryption at rest.

Zero-Disk Injection

When the runenv-cli fetches secrets, they are transmitted over TLS. The CLI spawns your application as a child process and injects the secrets directly into the env object of that process. The secrets are never written to a .env file on disk.

Deployment and latency

Request latency depends on the RunEnv deployment, database region, network path, and the client's location. Secret retrieval responses must not be placed in a shared public cache; validate latency and availability in the environment where the application will run.