> ## Documentation Index
> Fetch the complete documentation index at: https://docs-2.manicule.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://docs-2.manicule.dev/docs/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://docs-2.manicule.dev/docs/api/mcp.
> Every agent surface: https://docs-2.manicule.dev/docs/.well-known/llms-manifest.json

# Encrypted Token Vault (/docs/security/token-vault)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 190 · updated: 2026-11-11 -->
Related: [Data Privacy & Zero Customer Code Training](/docs/security/privacy.md), [Execution Isolation & Security](/docs/security/sandboxing.md)

> AES-256-GCM encryption, credential isolation, and OAuth scope security.

Third-party integrations (GitHub, GitLab, Vercel, Netlify, Neon, Supabase) require access tokens to operate on your behalf. BhaiCode secures these credentials through the **Encrypted Token Vault**.

***

## Encryption Standards

* **AES-256-GCM Encryption**: All access tokens, refresh tokens, and API keys are encrypted at rest using AES-256-GCM.
* **Per-Tenant Keys**: Keys are derived per tenant using cryptographically secure key derivation functions (PBKDF2 / HKDF).
* **No Plaintext Storage**: Tokens are never stored in plaintext in databases, caches, or logs.
* **TLS 1.3**: All traffic between your client, the BhaiCode API, and third-party services is encrypted in transit.