> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/production-checklist/bindplane/secrets-management.md).

# Secrets Management

Manage Secrets with Bindplane

Managing sensitive information securely is critical when deploying monitoring solutions. Bindplane provides several approaches to help you protect credentials and other secrets used in your OpenTelemetry configurations. This guide outlines the available options and best practices for securing your sensitive data.

{% hint style="warning" %}
**IMPORTANT**

Bindplane Cloud automatically encrypts all Library Resources, Configurations, Snapshot Recordings, and Collector State information using Envelope Encryption, regardless of whether they contain sensitive data.

For self-hosted Bindplane deployments, encryption is not enabled by default. To enable encryption of sensitive data, you must configure your instance to integrate with Google KMS. Directions for this can be found [here](/production-checklist/bindplane/secrets-management/envelope-encryption.md#self-hosted-encryption-implementation). Customers must be using Postgres to enable this option. Encryption is not supported when using Boltstore, which is being deprecated.
{% endhint %}

### Available Methods

Bindplane offers multiple approaches to secure your secrets, with more options being developed:

<table><thead><tr><th width="129.7578125">Method</th><th width="101.26953125">Status</th><th>Description</th><th width="166.25390625">Bindplane Access</th></tr></thead><tbody><tr><td>Environment Variables</td><td>Available</td><td>Reference environment variables in Configurations</td><td>No Access</td></tr><tr><td>Envelope Encryption</td><td>Available</td><td>Use a managed KEK (Key Encryption Key) and an encrypted DEK (Data Encryption Key) to protect secrets</td><td>Limited Access *</td></tr></tbody></table>

{% hint style="info" %}
**NOTE**

* When using Envelope Encryption, the Bindplane Platform will need to decrypt the secret before transmitting the configuration to the selected Collectors. AES encryption can be used to symmetrically encrypt the secret before transmission using the [AES provider](/configuration/bindplane-otel-collector/configuration-encryption.md).
  {% endhint %}

{% hint style="info" %}
**NOTE**

When using Environment Variables, the Bindplane Platform does not access any secrets in the configuration. Only the Collector will have access.
{% endhint %}

### Choosing the Right Approach

The right secrets management approach depends on your security requirements, operational constraints, and existing infrastructure:

#### Environment Variables

Best for: Organizations with established environment management practices or simpler deployments. Kubernetes based deployments with integrated KMS in a Kubernetes cluster.

**Benefits**

* Secrets never leave customer premises
* Secrets are not in the collector pipeline YAML
* Works Out of the Box in Cloud or in a self-hosted deployment

**Drawbacks**

* More complex to manage at scale

#### Envelope Encryption

Best for: Organizations requiring enhanced security while maintaining operational simplicity.

**Benefits**

* Works out of the box in Bindplane Cloud
* Securely stores secrets in all Library Resources, Configurations, and Snapshot Recordings.
* Supports end-to-end encryption through integration with the [AES Provider](/configuration/bindplane-otel-collector/configuration-encryption.md) for enhanced security during configuration transmission

**Drawbacks**

* Requires configuration to work in a self-hosted scenario.
* Pipeline YAML in Collector will still contain secret values if [AES Provider](/configuration/bindplane-otel-collector/configuration-encryption.md) is not used.

### Getting Started

Explore our detailed guides for each method:

* [Using Environment Variables](/production-checklist/bindplane/secrets-management/using-environment-variables.md)
* [Envelope Encryption](/production-checklist/bindplane/secrets-management/envelope-encryption.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bindplane.com/production-checklist/bindplane/secrets-management.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.