Transit Secrets Engine
The Transit Secrets Engine provides "Encryption-as-a-Service" (EaaS). Instead of managing encryption libraries, key generation, and key rotation within your application code, you can offload these cryptographic operations to RunEnv.
How it works
When using Transit, your application never sees or handles the raw encryption keys.
- You create a Transit Key in the RunEnv dashboard (e.g.,
pii-key). - Your application sends plaintext data (like a user's Social Security Number) to RunEnv via the SDK or API.
- RunEnv encrypts the data using the latest version of
pii-keyand returns the ciphertext. - Your application stores this ciphertext in its database.
- When the application needs to read the data, it sends the ciphertext back to RunEnv, which decrypts it and returns the plaintext.
Key Types
RunEnv supports several cryptographic algorithms depending on your use case:
| Type | Use Case |
|---|---|
AES-256-GCM | General purpose authenticated symmetric encryption. |
RSA-2048 / RSA-4096 | Asymmetric encryption/signing. |
ECDSA-P256 | High-performance digital signatures. |
ED25519 | Modern, fast digital signatures. |
Automatic Key Rotation
One of the main benefits of the Transit Engine is Key Versioning. You can configure a key to rotate automatically every 30 days.
When a key rotates:
- New encryptions use the new key version (e.g.,
v2). - RunEnv retains the old key version (
v1) so it can still decrypt existing data. - The ciphertext returned by RunEnv includes the version prefix (
v1:iv:ciphertext), so RunEnv always knows which key to use for decryption.
Rewrapping Data
If a key rotates and you want to re-encrypt old data with the new key version, you can use the rewrap endpoint. This decrypts the ciphertext using the old key and immediately re-encrypts it using the latest key version, without the plaintext ever leaving the RunEnv server.