About varsafe

What varsafe is

varsafe is a secrets manager for developers and teams. It stores environment variables — database URLs, API keys, signing secrets — encrypted at rest, and hands them to the process that needs them without writing a .env file to disk. The primary interface is the command line: varsafe run -- your-command injects secrets into the child process and nothing else. The dashboard exists for the management tasks a terminal is bad at, such as inviting teammates, reviewing the audit trail, and approving an AI agent's access.

Every read and write of a secret is recorded in an append-only audit trail. Access is scoped: an API token can be limited to a single project and environment, and an agent connecting over the Model Context Protocol receives only the capabilities the person approving the connection granted it. Secrets are encrypted in transit and at rest, and plaintext values are never written to logs.

Who builds it

varsafe is built and operated by G Networks, registered in France under SIREN 753 647 585, at 100 rue Vulfran Warme, 80000 Amiens, France. It is an independent, self-funded product — there is no investor timeline shaping what ships. The people who write the code also run the infrastructure and answer the support mail, which is deliberate: a secrets manager whose authors never carry the pager drifts away from how it is actually used.

Where it runs

The service is hosted in the European Union and operated under the GDPR. Data residency is not a paid add-on — there is one region and it is in the EU. Uptime and incident history are published on our status page, and the details of what is stored and for how long are in the privacy policy.

Built for automation, not just people

CI pipelines and AI coding agents need secrets as much as humans do, and both are bad at filling in contact forms. So everything is self-serve: create an account, create a scoped API token, and a pipeline can inject secrets with a single command. Agents connect to the hosted Model Context Protocol endpoint over OAuth 2.1 with named scopes, so a tool can be granted the ability to list secrets without ever being able to read their values. The API surface is published as an OpenAPI specification and a machine-readable orientation file lives at /llms.txt.

Talk to us

Questions, security reports, and bug reports all go to the same place: the contact form, orsupport@varsafe.dev. Product documentation lives at docs.varsafe.dev.