Docs / Team and security

How Ladeworks keeps credentials safe

You give Ladeworks the keys to your systems, so here is what it does with them. This page says only what is built today. The security page has the wider picture.

Encrypted, and never shown in full

• API keys, tokens, passwords and SSH keys are encrypted at rest with AES-256-GCM before they are stored.
• After you save one, the app shows only a masked hint, such as ••••4f2a: four bullets and the last four characters. A secret that is too short to show four characters safely is shown as •••• alone.
• The full value is never sent back to your browser. The field is write-only: to change it, choose Replace key, Replace token, Replace password or Replace secret and enter the new one. The current one keeps working until you save.

(opens the full size image in a new tab) (opens the full size image in a new tab)

Workflows, tests and connection checks use the stored credential to sign in to your system for you. Anyone who can edit an integration can replace a credential, but nobody can read the old one back, including them.

Fields that are not secrets are shown to people who can edit the integration. The OAuth extra parameters say so: "Don't put secrets here."

Requests to your systems

Every request Ladeworks makes to one of your systems goes through one gateway. It blocks connections to private and internal network addresses (checked again after name lookups and after every redirect), applies timeouts and per-integration rate limits, and counts each request toward your API calls. Requests come from a small, stable set of IP addresses that you can allow in your own firewall.

Downloads of a run's requests and responses strip sensitive headers, such as Authorization, API key headers and cookies, and stored request addresses have credentials in the address redacted.

Credentials are kept out of other places

• Messages to support never include credentials, payloads or record data. The panel lists exactly what is sent.
• The "Missing something?" panel removes credentials from the page settings it can attach, and says "credentials are never included".
• Your Ladeworks password is hashed with argon2id, and recovery codes for two-factor are stored as hashes. The two-factor secret is stored encrypted.

What is not covered

• Payloads (the records inside runs) are not encrypted separately from the rest of the database in this version. Who can see them is controlled by payload access, and they are deleted after your plan's retention period.
• Ladeworks does not hold any security certifications or audit reports at this time, and does not claim any. If you need a security review, ask through the security page.