- Home
- Secrets Management Tools
- Envshed
Envshed
What it is
Envshed is a cloud secrets manager for small engineering teams, with a CLI that handles secrets and environments across monorepos. It supports per-user overrides, expiration warnings, project duplication and an audit trail. For pnpm or npm workspaces, the CLI can detect workspaces and retrieve secrets for them from the repository root. Listed integrations include GitHub Actions, Docker, a Node.js SDK, a shell-compatible CLI and Coolify; a REST API supports use from languages such as Python, Go and Rust. Secret values are encrypted at rest with AES-256-GCM, traffic uses TLS 1.3, and keys are held separately from encrypted data. Envshed describes role-based access and an immutable audit trail, including records of secret reads and changes. It is not a zero-knowledge vault: a small on-call group with production credentials could technically decrypt secret values. Data is stored in a single region on US-based cloud infrastructure. Self-hosting is planned but not currently available, and Envshed says it is not yet SOC 2 or ISO 27001 certified. The Developer plan is free, for up to two members and three projects. Team costs $5 a month, and Business costs $9 a month; a 14-day trial is listed. The maker targets indie developers, early-stage startups of up to about 50 engineers and open-source maintainers running shared infrastructure.
For and against
For
- Free Developer plan includes up to two members and three projects.
- CLI can retrieve secrets across pnpm or npm workspaces.
- Supports GitHub Actions, Docker and Coolify integrations.
- Uses AES-256-GCM encryption at rest and TLS 1.3 in transit.
- Provides role-based access and an immutable audit trail.
Against
- Self-hosting is not currently available.
- Not yet SOC 2 or ISO 27001 certified.
- Not a zero-knowledge vault.
- Data is stored in a single US-based region.
The verdict
Envshed pairs a monorepo-oriented CLI with secrets management, audit records and listed developer integrations. Teams should weigh its cloud-only availability and the maker’s stated limits on zero-knowledge access and certifications.
Who it suits
Envshed is aimed at indie developers, early-stage teams of up to about 50 engineers and open-source maintainers managing shared infrastructure. Its monorepo workspace support is relevant to teams using pnpm or npm workspaces.
Plans and prices
Developer
up to 2 members · up to 3 projects · unlimited secrets · AES-256-GCM encryption
Read 15 Oct 2026 · envshed.com
Team
unlimited members · unlimited projects · unlimited secrets · CLI & API access
Read 15 Oct 2026 · envshed.com
Business
everything in Team · SAML SSO · priority support
Read 15 Oct 2026 · envshed.com
On the record
- Access and audit
- The maker describes role-based access control and an immutable audit trail, including records of secret reads and changes.envshed.com · read 7 Oct 2026
- Access control
- The platform describes organization, project, and environment roles including owner, admin, editor, and viewer.envshed.com · read 15 Oct 2026
- API
- The maker says Envshed offers a REST API for use from languages including Python, Go, and Rust.envshed.com · read 7 Oct 2026
- Audit trail
- Reads and writes are recorded with user, IP address, timestamp, and change information.envshed.com · read 15 Oct 2026
- Changelog: installer
- On April 16, 2026, Envshed announced a dedicated install.envshed.com host for CLI installation flows.envshed.com · read 15 Oct 2026
- Changelog: SAML
- On March 15, 2026, SAML 2.0 sign-in through Okta, Azure AD, Google Workspace, and other providers was added to Business.envshed.com · read 15 Oct 2026
- Changelog: service tokens
- On March 18, 2026, scoped machine-to-machine service tokens for CI/CD were announced.envshed.com · read 15 Oct 2026
- CLI
- The envshed CLI can pull, push, inject, import, run, version, snapshot, and roll back secrets.docs.envshed.com · read 15 Oct 2026
- Compliance
- Envshed says it is not yet SOC 2 or ISO 27001 certified and that SOC 2 Type II is on its roadmap.envshed.com · read 7 Oct 2026
- Data residency
- The service currently stores data in a single region on US-based cloud infrastructure.envshed.com · read 15 Oct 2026
- Documentation depth
- The documentation site contains getting-started material, a CLI reference with numerous subcommands, feature pages, integrations, configuration, and migration guidance.docs.envshed.com · read 15 Oct 2026
- Encryption
- Secret values are encrypted at rest with AES-256-GCM and traffic uses TLS 1.3.envshed.com · read 15 Oct 2026
- GitHub Action inputs
- The documented action accepts token, organization, project, environment, API URL, export mode, and file path inputs.docs.envshed.com · read 15 Oct 2026
- GitHub Actions
- The GitHub Actions integration fetches secrets and exports masked variables or writes a .env file.docs.envshed.com · read 15 Oct 2026
- Integrations
- Shipped integrations include GitHub Actions, Docker, Node.js SDK, a shell-independent CLI, and Coolify.envshed.com · read 15 Oct 2026
- Intended users
- The maker targets indie developers, early-stage startups of up to about 50 engineers, and open-source maintainers running shared infrastructure.envshed.com · read 7 Oct 2026
- Key features
- It provides a CLI, secret and environment management, per-user overrides, expiration warnings, project duplication, and an audit trail.envshed.com · read 7 Oct 2026
- Limit: outage behavior
- Already-pulled .env files continue working during an outage, but fresh envshed pull requests require the API to be available.envshed.com · read 15 Oct 2026
