Key and Credential Management

This page describes controls and rotation triggers, not a rotation interval. Publishing an interval we do not enforce would be a commitment dressed as a control. Where enforcement is documented but not yet automated, this page says which is which.

1. Where secrets live

Credentials are held centrally in a self-hosted secrets manager and delivered to services as rendered, file-scoped material — never checked into source control and never baked into container images. Services read what they need at the path they are scoped to; no service holds the estate's credentials.

2. Identity scoping

Each machine consumer authenticates as its own scoped machine identity rather than sharing a single administrative credential, and is authorised per project and per path. Bootstrap credentials on production hosts are root-owned, mode 0600, inside a mode-0700 directory — verified on both hosts, not assumed from one.

3. Expiry and monitoring

Machine-identity access tokens carry a machine-readable time-to-live, and a dedicated exporter polls the secrets manager read-only every five minutes to publish identity and rotation staleness as metrics. Two alert rules are loaded in the live monitoring system against those metrics. The bootstrap credential that obtains those tokens is itself long-lived; it is the root of the chain and is protected by the file controls in §2 rather than by expiry.

4. What triggers rotation

Rotation is event-driven, not calendar-driven:

suspected or confirmed compromise
a change of ownership, role or personnel with access
provider-side expiry or a provider forcing reissue
a credential moving between tiers or scopes
a policy requirement in a specific customer agreement

High-value provider keys follow a five-stage documented procedure — mint, deploy, verify, revoke, record — in which skipping a stage is prohibited, so that a rotation cannot leave a half-swapped credential live.

5. No fixed rotation interval is enforced

Stated directly because the honest answer is more useful than a comfortable one. Internal decision records define target rotation cadences for named high-value secrets. No automated job enforces those cadences today; rotation is performed against the triggers in §4 and recorded in an internal rotation log. We therefore do not offer a contractual rotation interval, and you should not infer one from any historical average.

6. Revocation and evidence

A credential is revoked at the secrets manager, which removes it from every consumer's next render rather than requiring per-host cleanup. Rotation events are recorded in an internal log that captures what was rotated, when, and the post-rotation verification that proved the new credential works — a rotation is not considered complete until the replacement is proven live.

7. Separation of authority

Human administrative authority and machine identities are separate: a machine identity cannot grant or widen its own authority, and the credential tiers are defined so that a compromise of a service credential does not yield administrative control.

8. What this page is not

These are current controls, not contractual commitments. No rotation interval, key-management SLA or cryptographic guarantee applies unless it is written into a signed agreement. We hold no third-party security certification at this stage — see Security, which states that position plainly.