> ## Documentation Index
> Fetch the complete documentation index at: https://012e27a-docs-2.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://012e27a-docs-2.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://012e27a-docs-2.manicule.dev/api/mcp.
> Every agent surface: https://012e27a-docs-2.manicule.dev/.well-known/llms-manifest.json

# Encrypted Token Vault (/security/token-vault)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 227 · updated: 2026-11-12 -->
Related: [Security & Privacy](/security/overview.md), [Data Privacy & Zero Code Training](/security/privacy.md), [Execution Isolation & Security](/security/sandboxing.md)

> AES-256-GCM encryption, per-tenant keys, and minimal OAuth scopes for connector credentials.

Integrations (GitHub, GitLab, Vercel, Netlify, Neon, Supabase) need access tokens to act on
your behalf. BhaiCode keeps those credentials in the **Encrypted Token Vault**.

## Encryption standards

* **AES-256-GCM at rest**: access tokens, refresh tokens, and API keys are encrypted with an
  authenticated cipher.
* **Per-tenant keys**: keys are derived per tenant with secure key-derivation functions
  (PBKDF2 / HKDF).
* **No plaintext storage**: tokens never appear in plaintext in databases, caches, or logs.
* **TLS 1.3 in transit**: traffic between your client, the BhaiCode API, and third-party
  services is encrypted.

<Check title="Least privilege">BhaiCode requests the minimum OAuth scopes a connector needs. If a connector asks for more
than you expect, stop and check the consent screen.</Check>