Security
Secrets stay secrets.
TeamShare is built so credentials, keys, and private project context stay protected — at rest, in transit, and in the hands of the right people.
Encryption at rest
Every environment variable is encrypted with AES-256-GCM using a key per workspace, held in cloud KMS. The database stores ciphertext only — a plaintext secret never touches storage.
Keys never leave the KMS, and application logs never receive values.
Access control that means it
Five company roles — Owner, Admin, Member, Viewer, Secret Manager — and four project roles, enforced by the server on every request — for people and agents alike. Access is enforced on every request, so it is deliberate, not accidental.
Viewers see the work, never the secrets — and neither do agents.
A complete audit trail
Every reveal, export, and change to a secret is recorded — who, when, and where. Agent actions land in the run history too, so nothing — human or AI — is silent.
Audit views are read-only by design.
Secrets never surface in plaintext
Values are masked everywhere except a reveal-on-click that asks for confirmation. A redaction pipeline strips secret-shaped data from logs, errors, and API responses.
Accounts you can trust
Email verification on signup, Google OAuth as an option, and password resets with expiring tokens. Sessions are signed JWTs that refresh automatically.
Invitations with an expiry
Invites expire after 7 days and carry the role chosen at send time — so access decays instead of lingering indefinitely.
TeamShare is early in its compliance journey; certifications like SOC 2 are on the roadmap. Until then, our security claims are exactly what we ship: encryption, role-based access, audit trails, and redaction.
Ready when you are
Start sharing in minutes.
Create an account, set up a workspace, and add your first project — all before your next coffee.