How we protect your key

The App Store Connect .p8 is the most sensitive thing you give us. This page lists the real controls — not a SOC 2 badge we do not have yet.

1. 1
   Envelope encryption

   Per-account DEK wrapped by KMS. Ciphertext only in Postgres.
2. 2
   Decrypt in jobs

   Web and staff have no kms:Decrypt. Plaintext never hits disk.
3. 3
   Audit every unwrap

   secret.decrypted rows appear on Settings → Security.
4. 4
   One-click revoke

   Delete the row and destroy the DEK. Crypto-shred.
5. 5
   No signing certs

   Xcode Cloud keeps signing on Apple. We never store a .p12.

Setup steps live in Docs. Your audit log is at Settings → Security.