Privacy Policy

1. Introduction

At EnvGuard ("we," "our," or "us"), accessible from https://getenvguard.com, we take your privacy and data security with the utmost seriousness. This Privacy Policy outlines how we collect, process, encrypt, and safeguard your personal information and environment variables when you use our web platform and CLI services.

2. Information We Collect

We collect only the minimum necessary information required to provide secure environment variable management:

• Account Credentials: Email address, display name, and avatar image (when signing in via Google OAuth, GitHub OAuth, or Email OTP).
• Encrypted Secret Data: Keys and values of environment variables you store on EnvGuard. All secret values are encrypted on client/server boundary using enterprise-grade AES-256-GCM before database storage.
• Workspace & Audit Logs: Project names, environment titles, and activity audit trails (e.g., secret update timestamps, read actions).
• Billing Information: Subscription status and transaction identifiers processed securely via Opn PromptPay Gateway. We never store credit card numbers or banking PINs.

3. How We Protect Your Secrets (AES-256-GCM Encryption)

4. Third-Party Service Providers

We work only with vetted, enterprise-tier cloud infrastructure providers compliant with global security standards (SOC 2, ISO 27001):

• Database Hosting: Neon Cloud PostgreSQL (TLS 1.3 encrypted connections).
• Hosting & Edge Runtime: Vercel Global Edge Network.
• Payment Processing: Opn Payments (PromptPay Gateway).
• Email Verification: Resend API for delivering 6-digit OTP verification codes.

5. Your Data Rights (GDPR & PDPA Compliance)

Under Thailand PDPA and International GDPR regulations, you maintain full control over your data:

• Right to Export: Download all your .env files and audit logs at any time.
• Right to Erase: Delete projects, secrets, or request full account deletion via your settings panel.
• Right to Rectify: Update your profile or workspace ownership instantly.