Data Protection
Temps encrypts environment variables, TLS keys and provider credentials with AES-256-GCM using a key stored outside the database, hashes passwords (Argon2) and API keys (SHA-256), and serves traffic over TLS 1.2/1.3.
Because Temps is self-hosted, the database and the encryption key both live on servers you control. Your data is not sent to Temps or to third parties; the binary does send anonymous product telemetry unless you set TEMPS_TELEMETRY=0 (see Data ownership and privacy).
Encryption at rest
Sensitive values are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately from the database (see Key management below), so a database leak alone does not expose the plaintext. Every value is encrypted directly under that one key; Temps does not use envelope encryption with per-record data keys.
Encrypted (reversible, so Temps can use the value):
- Environment variable values. Values marked as secrets are also write-only: the API never returns them in plaintext
- TLS certificate private keys
- OIDC provider client secrets
- Email provider credentials (SMTP passwords, SES access keys, etc.)
- Managed-service credentials (database passwords, S3 keys), Git provider tokens and DNS provider credentials
- Agent sandbox secrets
Hashed (one-way, cannot be decrypted):
- User passwords, with Argon2
- API keys, with SHA-256. The plaintext is shown once at creation and cannot be retrieved later
- Preview and environment passwords, with Argon2
Deployment tokens keep both: a SHA-256 hash for lookup and an AES-256-GCM encrypted copy so Temps can inject the token into new deployments.
Encryption in transit
All traffic between clients and your Temps instance is encrypted with TLS:
- Automatic TLS via Let's Encrypt for every custom domain and the control-plane console
- TLS 1.3 preferred; TLS 1.2 retained for compatibility
- HSTS —
Strict-Transport-Securityis part of the security headers settings, which are off until you enable them globally or per project - Internal service communication — traffic between the control plane and worker nodes passes over authenticated channels (see Multi-node)
What's encrypted
Encrypted (AES-256-GCM, reversible)
| Data | Notes |
|---|---|
| Environment variables | All values; secrets are additionally write-only |
| TLS private keys | Per-domain keys |
| OIDC client secrets | |
| Email provider credentials | |
| Managed-service, Git provider and DNS provider credentials | |
| Deployment tokens | Encrypted copy, plus a SHA-256 hash for lookup |
Hashed (one-way)
| Data | Algorithm | Notes |
|---|---|---|
| User passwords | Argon2 | Hashed, not encrypted; the plaintext is never stored |
| API keys | SHA-256 | Plaintext shown once on creation |
| Preview / environment passwords | Argon2 |
Elsewhere
| Data | Protection |
|---|---|
| All HTTP traffic | TLS in transit |
| Backup data | Depends on your S3 bucket's at-rest encryption settings |
Key management
The AES-256-GCM encryption key is stored at ~/.temps/encryption_key (or encryption_key inside your configured TEMPS_DATA_DIR). It is generated automatically on first start and never changes unless you replace it.
Protect this file. A backup of the database without the encryption key cannot decrypt any secrets. Conversely, the encryption key without the database is useless. Keep them in separate, secure locations.
Backup recommendations
- Back up
~/.temps/encryption_keyto a separate, access-controlled location (not alongside the database backup) - If running Temps in a container, mount the key from a secrets manager or encrypted volume rather than baking it into the image
- Temps has no built-in key-rotation command. Rotating the key means re-encrypting every stored secret yourself, so plan for it before you need it
Key loss
If the encryption key is lost, encrypted values cannot be recovered. You would need to re-enter environment variables, provider credentials and other secrets manually. Deployments, projects, and analytics data are unaffected.
For access control and audit trails, see Authorization and Audit logging. Loading secrets from Vault, AWS Secrets Manager or Infisical is part of Temps Premium.