Umbra
Secrets under your keys
Secrets and fleet data under your keys, moving toward keys we never hold.
Under your keys today; the roadmap is keys we never hold, on an externally audited protocol.
Fleet data and secrets are encrypted under an envelope key we hold and delete on account termination or request, which makes them permanently unreadable, a crypto-shred with nothing to configure. Static blobs stored with us are opaque to us at rest. Enterprises can bring their own KMS key (BYOK). The roadmap moves toward keys we never hold, on an externally audited protocol.
- Encrypted by default under an envelope key we delete on account termination or request, a crypto-shred.
- Static blobs stored with us are opaque to us at rest.
- Roadmap: client-held keys with an externally audited protocol.
“Aren’t you just my new breach target?”
Any platform that holds your fleet data becomes something worth attacking. The fair question from a security leader is simple: if we adopt you, what can you read, and can we cut you off? Umbra is Alyria's answer on custody, and it is deliberately honest about what ships today versus what is on the roadmap.
The questions your reviewers will ask.
“What can you read at rest?”
Fleet data and secrets are encrypted under an envelope key we hold and delete on request; static blobs stored with us are opaque to us at rest.
“Can we hold the key ourselves?”
Enterprises bring their own KMS key (BYOK), or hold a key they never share with us (HYOK), and revoke it themselves.
“How do we cut you off?”
Delete the envelope key, or revoke your own, and our access ends. It is the standing arrangement, not a demo trick.
“Can agents share secrets safely? (roadmap)”
Agent-to-agent key exchange, so two agents can share files and secrets that stay encrypted end to end, is on the roadmap.
“When will you claim more? (roadmap)”
Client-held keys, where we never hold the key, ship only behind an externally audited protocol. We upgrade the claim when you can check it, not before.
Evidence, not assurances.
What a security leader walks away able to demonstrate to a board or an auditor.
- A custody arrangement you can verify, not a slogan you take on faith.
- Enterprise BYOK / HYOK that you control and revoke.
- Roadmap claims labeled as roadmap, pending an external audit.
- Default custody
- Envelope key we delete (crypto-shred)
- Enterprise
- BYOK / HYOK
- At rest
- Opaque static blobs
- Roadmap
- A2A brokering, client-held keys (externally audited)
- Status
- Secrets under your keys today
One module of the Alyria platform.
Umbra works alongside the rest of Alyria — prevention and detection for every AI agent your people run, tied together by one policy engine and one signed audit chain.
Put Umbra to work.
Deploy Beacon read-only and see how Umbra fits at the endpoint, under your keys.