Now in public beta

Secret management
you actually like

Every environment’s secrets under AES-256-GCM envelope encryption, with roles, versions and a full audit trail — then sink pull them straight into your .env.

The Sink dashboard home, showing total secrets, rotations due and integrity status for a workspace

Built on primitives you can name, not a black box.

AES-256
GCM, with a per-secret DEK
5 levels
Workspace to secret
4 roles
Viewer, Member, Admin, Owner
Every write
Logged to the audit trail

One place for every environment.
Engineered for security, refined for simplicity.

Envelope encryption

Every secret gets its own AES-256-GCM data encryption key, and that key is itself encrypted under the master key before it touches the database. Two layers, and no plaintext at rest — not the value, not the key that opens it.

AES-256-GCM · Per-secret DEK

Structure that isolates

Workspaces hold teams, teams hold projects, projects hold environments. Dev, staging and production never see each other’s values.

Workspace → Team → Project → Env

Roles, and a record

Four tiers — Viewer, Member, Admin, Owner — decide who can read and who can change. Every read, write, delete and share is written to the audit log with the member and the timestamp.

RBAC · Audited access

Bring what you already have

Pull your variables straight out of Railway, Vercel, Render, Doppler, Infisical, AWS Secrets Manager or Azure Key Vault — or paste a .env. You see the exact diff before anything is written, and choose whether existing keys are skipped or versioned. Credentials are used for that one request and discarded, unless you save them as a connection.

Railway · Vercel · Render · Doppler · Infisical · AWS · Azure · .env

Share without onboarding

Hand a contractor one key or a whole environment through a link that expires and dies after a set number of views. No account needed on their end.

Single-use · Expiring

Versions, not guesswork

Every update keeps the one before it. Each version carries its own encryption, its timestamp and the member who made the change, so rolling back is a lookup rather than an archaeology project.

Full version history

A CLI that speaks .env.
Four commands, and done.

sink init links a directory to an environment. pull writes the .env, push sends it back, diff shows the drift first. Your API key lives in the OS keyring, and any version of a secret is one flag away.

~/acme/api
$ sink init
 Linked ./api → acme / backend / production

$ sink pull
 Wrote 24 secrets to .env

$ sink diff
~ DATABASE_URL          local ≠ remote
+ STRIPE_WEBHOOK_SECRET remote only

Transparent options for teams of all sizes.
Billed monthly in USD.

Envelope encryption, roles and the full audit trail are on every plan.

Free

For trying Sink out on a single project.

$0 / month
Start free
  • 1 workspace, 1 project, 1 environment
  • Up to 100 secrets
  • 3 seats and 2 teams
  • Imports from Railway, Vercel & Render

Starter

Popular

For small teams running real workloads.

$7 / month
Get started
  • 3 workspaces, 25 projects, 10 environments each
  • Up to 2,000 secrets
  • 10 seats and 10 teams per workspace
  • Secure share links & secret versioning

Scale

Unlimited everything, for organisations.

$35 / month
Get started
  • Unlimited workspaces, teams & projects
  • Unlimited environments & secrets
  • 40 seats per workspace
  • Everything in Starter

Frequently asked questions.
The details, before you sign up.

Sink uses envelope encryption with AES-256-GCM. Each secret gets a unique data encryption key (DEK). The secret is encrypted with the DEK, then the DEK is encrypted with your master key. Neither the plaintext secret nor the raw DEK are ever stored — only ciphertext and the encrypted DEK.

Yes. Sink organizes secrets through a five-level hierarchy: Workspaces, Teams, Projects, Environments and Secrets. You can create separate environments for development, staging, production, or any custom environment — each fully isolated.

Sink supports three authentication methods: email/password login with bcrypt-hashed credentials, Google OAuth SSO, and GitHub OAuth SSO. You can also create API keys (prefixed with sk-) for programmatic access with configurable expiration.

Every secret operation is logged — create, read, update, delete, and share. Each audit entry includes the action type, the workspace member who performed it, the affected secret, and a timestamp. This gives your team full visibility into who accessed what and when.

Yes. You can bulk-create multiple secrets in a single request and retrieve them all at once. Every secret also maintains a full version history — each update is tracked with its own encryption, timestamp, and the member who made the change.

Stop passing secrets
around in Slack

Import an environment, invite your team and run sink pull — all on the free plan, no card required.