# Crunu FAQ: security, pricing and self-hosting > Answers to common questions about Crunu: what the server can see, lost passwords, pricing and limits, CI and agents, and running your own server. URL: https://crunu.com/faq Language: en Updated: 2026-10-31 **Frequently asked questions** The questions teams ask most before they move their secrets to Crunu, gathered from across the site. Each section links to the page with the full story. ## Getting started What the server sees, lost passwords, moving secrets in, CI systems and machines. ### What can the server see? One encrypted record per version of each environment, plus public keys and signed documents. It also sees metadata: the names of organizations, projects, environments and machines, member emails, the audit log, and the size and time of each version. Variable names and values exist only inside the ciphertext, and your password and Secret Key are never sent at all. ### What if I forget my password or lose my Secret Key? There is no password reset, because the server can’t perform one. Your recovery code opens the account after a waiting period, one hour by default; the account holder is notified, and a normal sign-in cancels the attempt. An admin can also move your personal environments to a new account. Keep the Emergency Kit you print at sign-up somewhere safe. ### Which CI systems does it work with? GitHub Actions, GitLab CI and Bitbucket Pipelines, with OIDC binding to the repository, branch and deployment environment. Any other OIDC issuer works through a generic provider. A CI system without OIDC can use a service token stored in its secrets together with crunu run. ### Which operating systems does the agent support? Linux and macOS, on amd64 and arm64. On Linux the agent can run as a systemd service that keeps environments in memory. On macOS it works from the command line, for people and service tokens. Windows is not supported. The web app needs Chrome 113, Safari 17, Firefox 129 or newer. ### Can I bring secrets over from another tool? Drag in .env files, INI files such as ~/.aws/credentials, flat YAML or any text file, including whole folders like .aws, up to 300 files at once. Crunu reads the variables and suggests where each file lives on disk. There is no direct import from 1Password, HashiCorp Vault, Doppler or Infisical. ### Does revoking a machine take effect right away? The server stops serving it at once, and the keys of the environments it held are rotated. The agent erases its copy within minutes while the machine is online, since it checks in every minute by default. An offline machine stops when its lease ends, 24 hours by default. A process that is already running keeps its variables until it restarts. Read more: [How Crunu works](https://crunu.com/how-it-works) ## Security Who can read your secrets, what happens if the server is breached, and which certifications Crunu doesn't have. ### Can the people who run app.crunu.com read my secrets? No. The server stores ciphertext and has no key to decrypt it. As the operator, Crunu does see metadata: names of organizations, projects, environments and machines, email addresses, the audit log, and the size and time of each version. One risk applies to every web-based vault: a compromised server could serve a modified web app that sees your password and Secret Key when you sign in. Signed releases and a strict content security policy reduce that risk, and the limitations page explains the rest. ### What happens if your server is hacked? Whoever breaks in gets ciphertext, public keys, keyed hashes of tokens and metadata. They can’t decrypt your values, add themselves to an access list or change a version without your devices noticing. They can stop serving you or send a tampered web page. If app.crunu.com is breached, we’ll email affected account holders without undue delay. ### Does Crunu protect against quantum computers? Partly. AES-256 and SHA-256 are expected to hold. X25519 and Ed25519 would fall to a large quantum computer, which doesn’t exist today. Crunu doesn’t use post-quantum algorithms today, so a database copy kept for years could one day expose the versions in it. Moving to post-quantum cryptography is on the Crunu roadmap. ### Is running my own server safer than app.crunu.com? It changes whom you trust, not the encryption. Your own server keeps the database and its backups with you and sends the web page from infrastructure you control. In return, backups, updates and the server’s own secret become your job. Self-hosting is available on the Enterprise plan, under a signed agreement: write to support@crunu.com. ### How do I report a vulnerability? Email security@crunu.com with the steps to reproduce it, and leave real secrets out of the report. The same contact is in our security.txt file, and the Security model page lists the rules for testing. ### Is Crunu SOC 2 or ISO 27001 certified? Crunu doesn't claim any certification or independent security audit today. To assess it, review the security model, the limitations page and your own exported audit log. Read more: [How secure is Crunu](https://crunu.com/security/threat-model) ## Pricing and plans Cost during early access, limits, sign-in and deleting your data. ### Is Crunu really free? Yes, during early access. Every feature is included, and the product has no billing, so there’s nothing to pay for. ### Do I need a credit card? No. Signing up asks for your email, a code from that email, your name and a team name. Your password and Secret Key are then created in your browser. ### What happens when early access ends? Prices for after early access aren’t set. If paid plans arrive, they’ll be announced at least 30 days in advance, and nothing is charged until you opt into one yourself. ### Is there a limit on team members? Crunu doesn’t count seats. The limit that matters is per environment: its access list holds up to 5,000 entries for people, machines and service tokens. ### Can people sign in with single sign-on? No. Crunu doesn’t offer single sign-on for people through SAML or OIDC, or sync with a user directory. People sign in with a password and Secret Key plus a second factor: a TOTP app or a passkey. OIDC is used only for CI jobs. ### Is there an uptime guarantee? No. Early access comes without a service-level agreement. Keep an offline copy of your environments: it opens with your password and Secret Key, without the server. ### Can I delete my account and my data? Yes. Deleting an account asks for your password and Secret Key again. If you’re the only owner of an organization, delete the organization or make someone else an owner first. Deleting an organization revokes its machines and stops its share links, and the server then removes its data. Read more: [Pricing](https://crunu.com/pricing) ## Self-hosting Running your own Crunu server on the Enterprise plan, and moving between servers. ### Is app.crunu.com the same software Enterprise customers host themselves? Yes. app.crunu.com runs the same Crunu server, deployed to Cloudflare Workers with a D1 database. ### Can I move from app.crunu.com to my own server later? Your own server needs the Enterprise plan, and the move isn’t one step. The archive that moves a server between platforms is made from the server’s whole database, and on app.crunu.com only the operator has access to it. At any time, you can export each environment you can read as a .env file or download an offline copy, then add those files to your own server. History, access settings and the audit log don’t carry over this way. ### Is AWS supported? Partly. The Crunu script deploys to AWS App Runner, but AWS has closed App Runner to new customers, so it works only in accounts that already use it. Crunu has no script for Amazon ECS Express Mode, the service AWS recommends instead. With a new AWS account, choose Cloud Run, Vercel or your own server. ### What happens to machines and CI during a move? Machines keep running on the variables they already have, for the length of their lease, up to 24 hours. Ask the team not to change environments or invite people for 15 to 30 minutes while you switch: anything written to the old server after the export won’t reach the new one. ### Can I run several server instances for high availability? On Postgres, several instances can share one database: audit log writes are serialized by a database lock. There’s no guide for a failover cluster, so plan it as your own setup. ### Do the operator tools have an English interface? Yes. server-init, doctor and crunu-server print in English, or in Russian when CRUNU_LANG or the system locale is Russian. ### How do I get the server for self-hosting? Through the Enterprise plan. Self-hosting is available to Enterprise customers under a signed agreement, and the server software is provided as part of that agreement. Write to support@crunu.com and say which platform you plan to use. Read more: [Self-hosting](https://crunu.com/self-hosting)