Sign inBook a demo

Overlap rotation · verify before revoke

Rotate every key.
Touch none.

KeyPilot rotates third-party and cloud API keys on schedule, pushes them to where your apps read secrets, verifies them live, then revokes the old key. No human ever sees or copies one.

Start rotatingRead the security model
rot_8f2astripe-live-keycreating new key at provider
  • GitHub Actions
  • GitLab CI
  • Bitbucket
  • Vercel
  • Netlify
  • Render
  • Fly.io
  • Heroku
  • AWS Secrets Manager

The problem

Policy says rotate every 30 to 90 days. The manual way makes every rotation a leak.

  1. Log in to the provider dashboard
  2. Generate a new key
  3. Copy itclipboard
  4. Paste it into several secret storesSlack, screenshots
  5. Redeploy
  6. Remember to revoke the old one

Cloud tools rotate database and cloud credentials. Most third-party APIs, from payments to email, AI and telephony, have no automated rotation at all.

How rotation works

Create, push, verify, revoke. In that order, every time.

  1. 01

    Create

    A fresh key is minted at the provider while the old one keeps serving traffic.

  2. 02

    Push

    The new key goes straight to every bound destination. No clipboard, no Slack, no human.

  3. 03

    Verify

    A live call proves the new key works. App health checks must stay green.

  4. 04

    Revoke

    Only then is the old key revoked. Any failure rolls back automatically.

$ keypilot rotate stripe-live-key --wait
→ creating new key at provider

Integrations

Rotates at the provider. Delivers where your apps already read secrets.

Providers with a key-management API get native connectors. Providers without one get browser-automation connectors that run in the secure zone, and they are labelled as such. Anything else: build it with the Connector SDK.

Connects with

Payments

  • Stripe
  • Adyen
  • PayPal
  • Square
  • Braintree

AI

  • OpenAI
  • Anthropic
  • Google Gemini
  • Cohere
  • Mistral

Messaging

  • Twilio
  • SendGrid
  • Mailgun
  • Postmark
  • Vonage
  • Slack apps

Cloud

  • AWS IAM
  • GCP service accounts
  • Azure app secrets
  • Cloudflare
  • DigitalOcean

Dev tools

  • GitHub
  • GitLab
  • npm
  • Docker Hub
  • Datadog
  • Sentry
  • PagerDuty

Data

  • MongoDB Atlas
  • Snowflake
  • Supabase
  • PlanetScale
  • Algolia
  • Elastic

Business SaaS

  • HubSpot
  • Salesforce
  • Shopify
  • Zendesk
  • Intercom

Destinations

  • GitHub Actions
  • GitLab CI
  • Bitbucket
  • Vercel
  • Netlify
  • Render
  • Fly.io
  • Heroku
  • AWS Secrets Manager
  • GCP Secret Manager
  • Azure Key Vault
  • Kubernetes
  • Doppler
  • 1Password
  • HashiCorp Vault
  • .env via agent

Leak response

A leaked key is replaced before anyone finishes reading the alert.

Leak signals arrive from GitHub's secret scanning partner program, GitGuardian, and KeyPilot's own public-repo and paste-site scanner. Each signal is confirmed with the provider, then the key is rotated. Our design target: revoked and replaced within 60 seconds of detection.

Rotate first, ask laterOptional mode for confirmed leaks. Approvals happen after the key is already dead.

Approvals and audit

Approve from your phone. Hand the auditor a file.

  • Approvals on iOS, Android, Slack and Microsoft Teams, bound to one rotation and expiring in 15 minutes
  • SSO with SAML or OIDC, SCIM provisioning, roles, and break-glass access that requires a written reason
  • Hash-chained audit log, mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls; export to PDF, CSV, Splunk, Datadog or Sentinel

Security

Designed on the assumption that our own control plane gets breached.

Plaintext stays in the enclave

Keys are decrypted only inside isolated workers (AWS Nitro Enclaves or GCP Confidential VMs), held for under 5 seconds, then zeroed.

Envelope encryption per tenant

Each tenant has its own key-encryption key in a cloud HSM. Every secret gets its own AES-256-GCM data key.

Bring or hold your own key

Enterprise tenants can supply their KEK and revoke our access at any time, making their data unreadable to us.

Nothing kept long-term

A rotated key is kept only for the rollback window (24 hours by default), then destroyed. Your secret store stays the record.

Least-privilege credentials

Provider credentials are scoped to key management where possible, with a visible scope score and warnings.

Keys inside your network

The self-hosted agent creates and pushes keys locally and sends only key ID, fingerprint and status to the cloud.

Multi-tenant SaaS · US and EUSingle-tenant dedicated cloudFully self-hosted

Stop scheduling key rotations on a calendar.

Connect one provider and one secret store. Watch the first rotation run, start to finish.

Book a demoRead the docs