A secret hardcoded in code is a waiting incident — and when it leaks, manual rotation takes time. KeyGuard treats secrets as encrypted data, not variables.
Envelope encryption
Each secret's key (a « data key ») is encrypted by a root key. To read a secret, the service decrypts the data key; the root key is never exposed to the business app.
Rotation with no downtime
DB/API credentials renew on schedule. Old and new coexist during cutover; no restart. If a key leaks, revoke it in one click.
Immutable audit
Every secret access is logged and sealed (hash-chain). We know who read what, and history can't be rewritten.
The goal isn't zero secrets — it's a surface so small and so traceable that a leak stays an isolated event, not a catastrophe.