# Hanzo KMS — Hanzo AI > End-to-end encrypted secret storage with environment sync, automatic rotation, audit trails, and native K8s integration. kms.hanzo.ai # Hanzo KMS Secrets management Hanzo KMS is where the credentials your code needs actually live, so they stop living in a file somebody committed. The SDK seals a value on your machine before it goes anywhere: your passphrase becomes a key through Argon2id, that key becomes an organization key through HKDF-SHA256, and the value is sealed with AES-256-GCM. The organization key never leaves the client. What the server stores is a blob it cannot read. AES-256 Sealed on your machine K8s Secrets kept in step Audit Every read recorded MIT Run it yourself [Open KMS](https://kms.hanzo.ai)[Documentation](https://docs.hanzo.ai/docs/kms) ## What it holds and how it holds it A secret is a value under a path, a name and an environment, inside one organization. That is the whole model. ### Sealed before it leaves you Argon2id turns a passphrase into a key, HKDF-SHA256 turns that into the organization's key, and AES-256-GCM seals the value. The organization key stays on the client. Sharing with a colleague wraps that same key to their public key using a hybrid post-quantum exchange, so nobody has to send anybody a secret to share one. ### Into the process, not into a file Run a command with the secrets already in its environment, export a dotenv when a tool insists on one, or let the Kubernetes operator keep a Secret in step with what KMS holds. The CLI also reads your repository and its git history looking for values that escaped. ### Replacing one is deliberate Rotate is a command, and a write states the version it means to replace — so a second writer who read the old value is refused rather than quietly winning. Signing keys generate, sign and rotate through the same surface, backed by threshold MPC. ### Who read it, when, and why Reads and writes land in an append-only record written by a single writer off the request path, so keeping it never slows a fetch. An AI agent's read is attributed to that agent by name, not to whichever human's key it borrowed. ### One key, several languages A CLI for a laptop and for CI. SDKs in Go, Node and Python over the same routes. In-cluster callers can take the binary ZAP transport instead of HTTP, and it enforces the identical token and role checks. ### Fail closed, or do not start Every call carries a Hanzo IAM token verified against a cached JWKS; HMAC and alg none are refused outright. The organization comes from the verified token, never from a field the caller sets. Outside development the daemon will not boot without an issuer, an audience and a JWKS URL — there is no accidental open mode. A secret can be marked so that any agent read waits for a person to approve it, or is refused. ## Nothing lands on disk terminal ``` # Sign in, then point this directory at a path kms login kms init # Start the process with its secrets already in the environment kms run -- npm start # ...or write a dotenv, for a tool that insists on one kms export --format=dotenv # Replace a value kms rotate DATABASE_PASSWORD # Find the ones that already escaped, here and in git history kms scan ``` Open Source Revenue Sharing ### Up to 5% of compute goes back to open source Every deployment is SBOM-verified. Contributors to Infisical earn a share of compute revenue — transparent, on-chain, and customizable by the community. [Connect & Earn](https://hanzo.ai/open-source/dividends)[Learn More](https://hanzo.ai/open-source) ## Take them out of the repo Use it hosted, or run the same binary yourself. The source is MIT and the client is where the encryption happens either way. [Open KMS](https://kms.hanzo.ai)[View on GitHub](https://github.com/hanzoai/kms) ## Open source License: Apache-2.0[hanzoai/kms](https://github.com/hanzoai/kms) ## Get KMS Secrets + key management [Deploy to Cloud](https://console.hanzo.ai/deploy)[Self-host](https://docs.hanzo.ai/docs/kms)