One vault for people, servers and pipelines
Crunu keeps your team’s .env files, cloud credentials and API keys in projects and environments. Every value is encrypted in the browser or in the crunu agent, so the server stores only ciphertext.
- Encrypted on your devices, never on the server
- Every feature free during early access
- Our cloud at app.crunu.com, or your own server
From a .env file to a running process
Files go into environments. Each environment is sealed for the people, machines and pipelines that should read it, and the server in the middle holds only ciphertext.
- What you storeEnv files, INI files like
~/.aws/credentials, flat YAML and any other text, grouped by project and environment. - Who can open itPeople in the browser, servers through the crunu agent and CI jobs with a service token, each with only the environments granted to them.
- What you can checkSigned versions, a hash-chained audit log and, when someone leaves, a report of what they received.
Every environment sealed with its own key
Projects hold environments, and each environment is encrypted on your device with a key of its own. A developer with access to development never receives the production key.
Roles that decide who gets a key
Owner, Admin and Member run the organization. On each environment, Editor, Reader, Specific files and Operator decide who receives a key, and an operator never does.
Someone leaves, every key they held changes
Removing a member is one guided flow. It shows what they received, rotates the key of every environment they had, and ends with a list of values to reissue at your providers.
Servers receive only what you grant
Enroll a server with a single-use code and approve it after comparing its fingerprint. The agent keeps decrypted environments in memory and hands them to your app at start.
A token per pipeline, bound to one repository
Service tokens read only the environments you grant. An OIDC binding makes a token work only inside the repository and branch you chose, on GitHub Actions, GitLab CI or Bitbucket Pipelines.
Files for someone without an account
A share link opens selected files for a person outside your organization. The decryption key travels after the # in the address, which browsers never send to the server.
Production served only to your networks
Restrict an environment by network and the server serves its contents only to allowed addresses. Policies are signed, relaxing one waits 15 minutes, and tightening applies at once.
A log that shows any edit
Sign-ins, versions, rotations, tokens and links are linked in a hash chain. Verify it in one click, export it as JSONL, and send alerts to a webhook or email.
Every feature, free during early access
Crunu is free while it’s in early access, and every feature on these pages is included. These are the limits that apply to everyone.
What Crunu doesn’t do
The gaps below are real today. Knowing them up front is cheaper than finding them during a migration.
- No SSO or SCIMPeople sign in with a password, a Secret Key and a second factor. There’s no SAML or OIDC sign-in and no directory sync.
- Linux and macOS onlyThe agent runs on Linux and macOS. There’s no Windows build and no mobile app.
- No platform syncNo built-in sync to Vercel, Cloudflare, AWS Secrets Manager or GitHub Secrets, no Kubernetes operator and no SDKs.
- Seen stays seenCrunu rotates its own keys. Values at your providers are reissued by you, from a checklist.
Answers to common questions
Something else? Write to support@crunu.com
Is every feature included during early access?
Yes. Crunu is free during early access, and every feature on these pages is included.
Do I have to run my own server?
No. Sign up at app.crunu.com and start right away. If you’d rather host it yourself, the same server runs on your own machine or in your cloud account.
Where does the agent run?
On Linux and macOS, on amd64 and arm64. On Linux it can run as a systemd service. On macOS it’s a command-line tool for people and service tokens. There’s no Windows build.
Can Crunu rotate my API keys at the provider?
No. Rotation in Crunu changes the encryption keys of your environments. When a value itself has to change, such as a payment provider key, you reissue it at that provider, and Crunu’s checklist tells you which ones.
What can the server see?
Names of organizations, projects, environments and machines, email addresses, the audit log, and the sizes and times of versions. It can’t see values, and it doesn’t see variable names or file paths either: those are encrypted together with the values.
Start with one project and one teammate
Create an account, add an environment, invite someone, and see what the server keeps.