Terms & Conditions

By creating an account, accessing the EnvHQ web application, or using the envhqcommand-line tool (together, the "Service"), you agree to be bound by these Terms & Conditions ("Terms"). If you do not agree, do not use the Service.

EnvHQ lets you store, organize, and sync environment variables. Values are grouped by project and environment, can be edited in the web app, and can be pushed to or pulled from your terminal with the envhq CLI. Every project belongs to an organization — every account gets a personal one automatically, and you can also create or be invited to team organizations. Within an org, project access is role-based (Viewer, Editor, Admin), grantable to individual members or groups, and can be capped per environment (e.g. Editor on dev but Viewer-only on prod). Org membership and invites are handled by our identity provider's (Clerk) own hosted UI.

The Service is currently provided free of charge. We may introduce paid plans in the future, change or remove features, impose usage limits, or discontinue the Service at any time, with or without notice. Being free means we make no commitment to uptime, response time, data durability, or long-term availability beyond what is stated in this document.

• Accounts are authenticated through our identity provider (Clerk). You are responsible for keeping your login credentials and any recovery methods secure.
• CLI access uses personal access tokens generated from Settings → CLI Tokens. A token is shown to you only once, in plaintext, at creation time — we store only a one-way hash of it. Anyone who obtains a valid token can act as you within its scope, so treat it like a password: don't commit it, paste it into chat tools, or share it. Revoke a token immediately if you suspect it has leaked.
• You are responsible for the content of the environment variables you store. Don't use the Service to store unlawful content, or credentials/data you do not have the right to store.
• Because of the data-loss limitations described in Section 6, you are responsible for keeping your own independent backup of any secret you cannot afford to lose.

We take reasonable, currently-implemented measures to protect your data:

• Zero-knowledge, end-to-end encryption: every variable value is encrypted and decrypted in your browser or the CLI on your machine — never on our servers. Your passphrase derives a key that unlocks your personal keypair, which in turn unwraps a per-project encryption key; values are encrypted with that key using XChaCha20-Poly1305 before they're ever sent to us. We only ever store and transmit ciphertext — EnvHQ's operator cannot decrypt your values, with or without database access.
• Mandatory Recovery Kit: alongside your passphrase, we generate a one-time recovery phrase as an independent way to unlock your key if you forget your passphrase. See Section 6 for what happens if you lose both.
• Encryption in transit: the web app and CLI communicate with our servers over HTTPS.
• Hashed CLI tokens: personal access tokens are stored as SHA-256 hashes, never in plaintext; a leaked database cannot be used to recover a working token.
• Scoped, expiring tokens: CLI logins use a short-lived, PKCE-verified browser authorization flow producing tokens that expire after 7 days; tokens can also be scoped to a single project and to read-only access.
• Role-based, ownership-scoped access: every project belongs to an org, and the API enforces your resolved role (Viewer, Editor, Admin) on every request — you can only read or modify data you have a role on.
• Versioned history: every change to an environment is stored as a full, immutable version you can review or roll back to at any time.

This section exists so you can make an informed decision about what to store in EnvHQ. By using the Service you acknowledge and accept the following:

• Losing both your passphrase and your recovery phrase means permanently losing access to your data. Because decryption happens client-side under a key only you hold, there is no "forgot password" reset that preserves your data — the operator cannot recover it for you, by design. Store your recovery phrase somewhere safe and independent of your passphrase (e.g. a password manager or a printed copy in a safe place).
• Key names are not encrypted. Only variable values are end-to-end encrypted — environment, project, and variable-key names are visible to the operator, since the sync/diff logic that powers push/pull currently operates on names server-side.
• Revoking access doesn't retroactively revoke what was already seen. Removing someone's access to a project stops them from decrypting anything going forward, but we do not rotate the underlying encryption key on revoke — a former collaborator who already fetched values before being removed could still have a local copy of what they saw.
• No independent security audit or certification. The Service has not undergone a third-party security audit and does not currently hold certifications such as SOC 2 or ISO 27001.
• No undo for deleting an entire environment or project. Variable-level changes are versioned and recoverable (see Section 5), but deleting an environment or project outright is still permanent — there is no trash or "undo" for that. If it matters, keep a copy of it somewhere else.
• No formal SLA. We do not guarantee uptime, a support response time, or that any given feature will keep working without change.
• Software in active development.Data model, APIs, and CLI behavior may change as the Service evolves; we'll try to avoid breaking changes but cannot promise none will occur.

For a more detailed, plain-language explanation of how encryption and access control work today, see the Security documentation.

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, non-infringement, or that the Service will be uninterrupted, secure, or error-free.

To the fullest extent permitted by law, the operator of EnvHQ will not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, secrets, or revenue, arising from your use of (or inability to use) the Service — including, without limitation, loss caused by the absence of versioning or backups described in Section 6. Because the Service is provided free of charge, our total aggregate liability for any claim relating to the Service is limited to zero.

Deleting a project deletes its environments and variables; deleting an environment deletes its variables. These actions cascade immediately and, as described in Section 6, are not currently recoverable by us on your behalf. If you close your account, we will delete your data within a reasonable period, except where retention is required by law.

You agree not to:

• attempt to bypass, probe, or attack the Service's authentication or access controls other than through an authorized responsible-disclosure process;
• use the Service to store or transmit unlawful content, or credentials you are not authorized to hold;
• abuse or overload shared infrastructure (e.g. automated scraping, excessive API calls) in a way that degrades the Service for others;
• resell, sublicense, or provide the Service to third parties as your own product.

You may stop using the Service and delete your account at any time. We may suspend or terminate access to the Service, for any account, at our discretion — including for violation of these Terms, suspected abuse, or if we discontinue the free tier.

We may update these Terms as the Service evolves. We will update the "Last updated" date above when we do. Continued use of the Service after a change constitutes acceptance of the revised Terms.

Questions about these Terms, or a security concern you'd like to report responsibly, can be sent to security@envhq.dev.