Access to an environment is a key, not a checkbox
Crunu seals each environment’s key only to the people and machines that should read it. A developer with access to development can’t read production, because the production key was never sealed to them.
- Four roles on every environment
- Access profiles for whole groups
- Requests approved by an owner or admin
Two layers of roles
Organization roles decide who runs the organization. Environment roles decide what someone gets inside one environment, and they’re backed by keys.
- OwnerEverything an admin can do, plus appointing admins and owners and changing the organization’s settings. The last owner can’t be removed.
- AdminManages members, machines, tokens and the audit log, and reaches every shared environment through the organization recovery key.
- MemberGets only what’s granted: environment roles, given directly or through access profiles.
| Environment role | Reads | Edits | Receives |
|---|---|---|---|
| Editor | All files | Yes | The environment key |
| Reader | All files | No | The environment key |
| Specific files | Selected files | No | A sealed copy of those files |
| Operator | Nothing | No | No key; adds machines |
Invite, then check the fingerprint
An invitation is a link with a secret inside, valid for up to 7 days. The new member creates an account and sees a fingerprint; you compare it with them, on a call for example, and only then grant access.
- The key belongs to the person you invitedComparing the fingerprint confirms that nobody in between, the server included, swapped the key you’re about to grant access to.
- Signed invitationsThe invitation record is signed by the person who created it.
- Email confirmed by codeWhen the server has email set up, the new member confirms their address with a code.
Grant once for the whole group
An access profile is a named set of environment-to-role pairs, such as Developers: Editor on development and staging. Change it once and the change applies to every member in it.
- Every version is signedEach change to a profile is a new signed version, so you can tell who changed what.
- Direct or through a profileThe member’s access list shows where each role comes from: given directly or through an access profile.
- Room for large teamsOne environment’s access list holds up to 5,000 entries.
Let people ask for what they need
A member asks for access with a reason. The request shows up under Access requests and in the Pending actions count, where an owner or admin approves or rejects it.
- Operators ask for machinesAn operator, who never sees values, can request access for a machine or for a member.
- Members see only their environmentsThe server lists to a member only the environments in their access list. Owners and admins see every shared environment.
- People can come backA removed member can be readmitted without breaking the history of signatures.
What access control doesn’t cover
Roles decide who receives a key. They don’t expire on their own, and they can’t take back what someone already read.
- No end date for peopleAccess stays until you remove it. Invitations, share links, tokens, machine leases and break-glass access do expire.
- No SSO or SCIMMembers sign in with a password, a Secret Key and a second factor. There’s no single sign-on and no directory sync.
- Admins reach everything sharedOwners and admins can open all shared environments through the organization recovery key. Keep those roles small.
- Reading means copyingAnyone who decrypts a value can copy it. Removing access doesn’t unsee anything.
Answers to common questions
Something else? Write to support@crunu.com
Can someone with development access read production?
No. Each environment has its own key, and the production key is sealed only to the people and machines granted production.
What’s the difference between Reader and Specific files?
A Reader reads every file in the environment. Someone with Specific files gets a sealed copy of only the files you chose, refreshed when the environment is saved, and can’t edit.
Can I give a teammate access for one week?
Not with an end date. Access for people stays until you remove it. To hand over a few files for a limited time, use a share link with an expiry instead.
Does Crunu support SSO or SCIM?
No. There’s no single sign-on for people and no directory sync.
Why check a fingerprint when someone joins?
It confirms that the key you’re granting access to belongs to the person you invited, and not to anyone in between, the server included.
Set up roles before the team grows
Create your organization, add an access profile for developers and invite the first person.