Platform

Phase is a secrets management platform built on end-to-end encryption. It provides a secure way to store, manage, and deploy application secrets across your entire development lifecycle — from local development to CI/CD pipelines to production infrastructure.

This section explains the core abstractions that underpin everything in Phase. Whether you interact with Phase through the Console, the CLI, SDKs, or the API, these concepts remain the same.

Core Concepts

Organisations

An Organisation is the top-level entity in Phase. It represents your team or company and contains all your Apps, Users, and configuration. Every user belongs to at least one Organisation, and all resources are scoped to an Organisation.

Apps

An App maps to a single project, repository, or service. Apps contain Environments, which in turn hold your Secrets. Apps also control whether Server-side Encryption (SSE) is enabled on top of the default end-to-end encryption, and who has access to what.

Environments

Environments represent the stages of your development workflow — such as Development, Staging, and Production. Each Environment within an App holds its own set of Secrets, and access can be scoped per user or per Team at the Environment level.

Secrets

Secrets are the fundamental unit of data in Phase — encrypted key-value pairs that store your application configuration, API keys, database credentials, and other sensitive values. Secrets support multiple types, cross-environment referencing, personal overrides, tagging, comments, sharing, full version history, and automatic rotation on a schedule.

Dynamic Secrets

Dynamic Secrets are short-lived credentials for third-party services that are generated on-demand. Instead of storing long-lived static credentials, Dynamic Secrets create temporary, scoped credentials with automatic expiration, reducing your attack surface.

Users

Users are individual accounts within an Organisation. Each user has a unique set of cryptographic keys that enable end-to-end encryption, a sudo password that protects those keys, and a role that determines their permissions.

Service Accounts

Service Accounts are non-human identities used for programmatic access to secrets. They have their own cryptographic keyrings, can be assigned roles, and authenticate via tokens or external identity providers. Service Accounts are used by CI/CD pipelines, automation scripts, and machine-to-machine workflows.

Access Control

Access Control in Phase is based on a Role-Based Access Control (RBAC) system. Roles define granular permissions across organisation and app-level resources, and access to Apps and Environments can be granted to individual users or to Teams. Phase provides managed roles (Owner, Admin, Manager, Developer, Service) and supports custom roles.

Integrations

Phase integrates with your existing infrastructure to deploy secrets where they are needed. Integrations connect at the Environment level and automatically sync secrets whenever they change. This includes CI/CD platforms like GitHub Actions, GitLab CI, and CircleCI; cloud providers like AWS and Azure; container platforms like Docker and Kubernetes; and hosting platforms like Vercel, Railway, and Render. See the full list under Platform Integration.

Overview

Secrets flow from Phase to your applications through multiple channels:

• Console — Browse, search, and manage secrets through the web UI
• CLI — Inject secrets into local development with phase run, or manage them with phase secrets
• SDKs — Fetch secrets programmatically from your application code
• API — Access secrets over the REST API for custom integrations
• Syncing — Automatically deploy secrets to third-party platforms like AWS, GitHub Actions, Vercel, and more