The documents below govern the use of sharedenv: legal notice, privacy policy, terms of use and terms of sale. They are written in French and translated into English for convenience: if the two versions differ, the French version prevails.
The sharedenv.com website, the web application, the api.sharedenv.com API, the browser extension and the sharedenv command-line interface (together, the "Service") are published by Async Code, a French simplified joint-stock company with a sole shareholder (SASU) and a share capital of 100 euros, registered with the Nanterre trade and companies register under number 952 918 936, whose registered office is at 14 rue Perronet, 92150 Suresnes, France.
Maximilien Lentschener, president of Async Code.
The Service is hosted in France by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, registered with the Lille Métropole trade and companies register under number 424 761 419 (www.ovhcloud.com).
The sharedenv brand, the website, its texts, its visuals and the code of the Service belong to Async Code and are protected by intellectual property law. Any reproduction without permission is prohibited. The code of the command-line interface is published as open source under the Apache 2.0 license (github.com/SharedEnv/cli): that license governs this code.
To report manifestly illegal content or an abuse of the Service, write to hello@sharedenv.com with the nature of the content, where it is and your contact details. Vault contents are end-to-end encrypted: we cannot read them, but we can suspend the reported vault or account.
Async Code (see the legal notice) is the controller of the processing described here: your account, the security of the Service and billing. For any question about your data, write to privacy@sharedenv.com.
When an organization uses sharedenv for its teams, it is the controller of the data it places there about its members, and Async Code processes that data on its behalf, as a processor (see the article "Data processed on behalf of the customer" of the terms of sale).
sharedenv is designed so that we cannot read your secrets. They are encrypted on your device (browser, extension or terminal) before they leave it, with keys we do not hold. We never receive:
Our servers only keep encrypted data, public keys and what the Service needs to work. Part of it stays readable by our servers, because the Service uses it: the names of your vaults, the names of your secrets (for example DATABASE_URL), the names of your teams and organizations, and who shares what with whom. Do not put sensitive information there.
The sharedenv extension for Chrome signs in with a value derived from your password (never the password itself) and decrypts your secrets in your browser.
As for the website, the API keeps, with the device identifier, a pseudonymized IP address and the country derived from it, for the security of your sessions. The data the extension handles is used only for its operation: it is not sold, not transferred to third parties, and not used for advertising or to determine creditworthiness.
The sharedenv CLI (npm package @sharedenv/cli) keeps on your machine, in the ~/.sharedenv folder readable by you only, your session and the fingerprints of the keys you approved. It never stores your master password. The secrets it decrypts go where you ask (terminal output, file) or to the one program you start with sharedenv run. Its code is public.
We do no advertising, no profiling and no audience measurement, we sell no data and we send you no marketing.
Only the people at Async Code who need it to run the Service access your data, along with our processors:
Other users see what sharing requires: the members of a vault see your name and username, and someone who knows your exact email address can find your username and public key to share a vault with you. If you share a vault with the Kubbler team (a service also published by Async Code), it accesses the secrets of that vault like any member, solely for that service, and every read is recorded in the audit trail.
We only disclose data to authorities when the law requires it. By design, we cannot hand them your secrets in clear.
The website pages, and our emails when you open them, load their fonts from Google Fonts: your browser or email client then sends your IP address to Google.
Your data is hosted in France, in the European Union. Stripe may process some payment data in the United States, and Google receives in the United States the IP address of website visitors and of readers of our emails: these transfers are covered by the safeguards of these providers (EU-US Data Privacy Framework and the European Commission's standard contractual clauses).
Erased data may remain in technical backups until they are renewed, without being used.
On top of end-to-end encryption (AES-256-GCM, ECDH key exchange on secp256k1, password stretched with scrypt), the Service encrypts all traffic (HTTPS), never receives your password, offers two-factor authentication, limits sign-in attempts, pseudonymizes IP addresses and restricts server access to authorized people.
If a data breach puts you at risk, we notify the CNIL (the French data protection authority) within 72 hours, and we warn you without undue delay when the risk is high.
The Service only sets strictly necessary cookies, which require no consent:
No audience measurement, advertising or social network cookie is set. Your browser also keeps, in its local storage, your display theme and the fingerprints of the public keys of the people you share with, which reveal a key change. This data stays on your device.
You have the right to access, rectify, erase, restrict, object to and port your data, and the right to set instructions about what happens to it after your death. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest.
To exercise these rights, write to privacy@sharedenv.com from your account's address. We answer within one month, which may be extended by two months for a complex request, and may ask you to confirm your identity. Account deletion is requested the same way.
Since your secrets are encrypted with your own keys, we can only hand them over encrypted. You can export them in clear at any time, yourself, with the CLI (sharedenv pull -v <vault> --format json).
If you believe your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the data protection authority of your country.
The Service is for people aged 16 or over. The date of birth asked at sign-up is used only to make sure of it.
We may change this policy. The date at the top of the page shows its version, and we warn you by email of any significant change before it takes effect.
These terms of use (the "Terms of Use") govern the use of the sharedenv Service published by Async Code (see the legal notice). They apply to anyone who creates an account or uses the Service, free of charge or not. Paid plans are also governed by the terms of sale (the "Terms of Sale"). By creating an account, you accept the Terms of Use.
sharedenv is an end-to-end encrypted secrets vault. It lets you keep environment variables, API keys, shared logins and other secrets, share them with people and teams, and use them from the website, the browser extension and the CLI. The free plan is subject to the limits shown on the pricing page. The Service evolves: we may add, change or remove features, and we warn you in advance of a removal that affects the use of your account.
Your master password and your recovery code are the only keys to your vault. We do not know them and can neither recover nor reset them for you.
Keep your recovery code somewhere safe, away from your password. Async Code is not liable for data loss resulting from the loss of these items.
When you share a vault, its recipient receives the key that opens it and reads its secrets according to the rights you grant. Before accepting a share, or sharing with someone for the first time, compare your key fingerprints through another channel.
Removing a member prevents future access to the vault, but they may have copied the secrets they could read: rotate the vault key, and change sensitive secrets at their source (new API key, new password). The owner and the administrators of a vault decide who has access to it and are responsible for it. The administrators of an organization can restrict sharing within it.
You may not use the Service to:
Found a vulnerability? Write to us at hello@sharedenv.com. We will not take legal action against anyone who reports a vulnerability to us in good faith, without exploiting it, without accessing other people's data and without disclosing it before it is fixed.
You remain the owner of everything you store. You only grant us the right to keep and transmit your encrypted data, to the extent the Service requires. For the content you store, Async Code acts as a hosting provider within the meaning of the French law on confidence in the digital economy (LCEN): since it cannot read vault contents, it acts upon notice, by suspending the vault or account concerned when manifestly illegal content is reported to it.
We make our best efforts to keep the Service available and secure, but cannot guarantee uninterrupted availability: maintenance, an incident or an external cause may interrupt it. We announce planned maintenance when possible. Keep a copy of your critical secrets: you can export them at any time with the CLI.
The Service, its code, its brand and its content belong to Async Code. It grants you a personal, non-exclusive and non-transferable right to use the website, the web application and the extension for your own needs, for the life of your account. The CLI is published under the Apache 2.0 license: you may use, modify and redistribute it under that license. Any other reproduction is prohibited, as is decompilation beyond what the law allows.
You can stop using the Service at any time and ask for your account to be deleted at privacy@sharedenv.com. Export your secrets first: once the account is deleted, they cannot be recovered.
We may suspend or close an account that breaches the Terms of Use after a formal notice left unremedied for 8 days, or immediately in case of a serious threat to the security of the Service or of others, or of manifestly illegal content. An account with no subscription and no sign-in for 3 years may be deleted after a 30-day notice by email.
Async Code is bound by an obligation of means (best efforts). It is not liable for:
If you are a business, Async Code is not liable for indirect damage (loss of revenue, business, customers, reputation), and its total liability is limited to the amounts you paid it in the 12 months preceding the event giving rise to the claim, or to 100 euros if you use the free plan. These limits do not apply to gross negligence or willful misconduct, nor to bodily injury.
If you are a consumer, Async Code is liable for its failures under the conditions set by law, and nothing in the Terms of Use limits the rights the law grants you.
We may change the Terms of Use. We warn you by email at least 30 days before a significant change takes effect; if you do not accept it, you can close your account before that date. Continuing to use the Service after that date means you accept it.
The Terms of Use are governed by French law. If a problem arises, write to us first at hello@sharedenv.com: we will look for an amicable solution.
These terms of sale (the "Terms of Sale") apply to the paid subscriptions to the Service (Pro and Team plans) sold by Async Code (see the legal notice) on sharedenv.com, to consumers and businesses alike. They supplement the Terms of Use. You accept them when you subscribe, in the version in force on the date of your subscription, which remains available and printable on this page. You receive the confirmation of your subscription by email.
The Service offers a free plan and paid plans. The content, limits and price of each plan, and what that price is based on (for example the number of people who have access to your vaults), are the ones shown on the pricing page when you subscribe. The total amount to pay is shown to you before payment.
Prices are shown in euros, all taxes included. We may change our prices: a price change for an ongoing subscription is announced to you by email at least 30 days before it applies, and only takes effect from the next period. You can cancel before it takes effect.
You subscribe from your account, on the secure payment page of Stripe, our payment provider. The payment methods offered are the ones that page shows, and we never have access to your card details. The subscription starts when the payment is confirmed.
The subscription is monthly or yearly, as you choose. It is paid in advance and renews automatically for the same term until you cancel it. For a yearly subscription, we remind you by email, between one and three months before it ends, that you can choose not to renew it. Your invoices are available in your billing area.
When a plan is billed per person, adding people during a period gives rise to an additional amount calculated pro rata, which is shown to you before you confirm.
If a payment fails, you have 7 days to settle it. After that, your account goes back to the free plan and its limits; your vaults and secrets are not deleted.
You can change plan at any time from your billing area: the amount due and its date are shown to you before you confirm.
You can cancel at any time, in a few clicks, from your billing area. Cancellation takes effect at the end of the period already paid (the current month or year), until which you keep your plan. That period is not refunded, unless you exercise your right of withdrawal or the law provides otherwise.
If you are a consumer, you have 14 days from your subscription to withdraw, without giving any reason. By subscribing, you ask for the Service to start immediately: if you withdraw, you owe the amount corresponding to the service provided until your withdrawal, and we refund the rest within 14 days, using the payment method you used.
To withdraw, send us an unequivocal statement at hello@sharedenv.com before the period ends, for example using the following form:
"To Async Code, 14 rue Perronet, 92150 Suresnes, France, hello@sharedenv.com. I hereby give notice that I withdraw from my contract for the provision of the following service: [plan]. Subscribed on: [date]. Name of consumer: [name]. Address of consumer: [address]. Account email address: [email]. Signature of consumer (only if this form is sent on paper). Date: [date]."
The right of withdrawal does not apply to businesses.
If you are a consumer, you benefit from the legal guarantee of conformity of digital content and services (articles L. 224-25-1 and following of the French Consumer Code): if the Service is not in conformity, you can have it brought into conformity or, failing that, obtain a price reduction or the termination of the contract.
Async Code's liability is governed by the "Liability" article of the Terms of Use.
When a customer uses the Service for an organization or a team, it is the controller of the personal data it places there about its members (names, email addresses, team membership, audit trail of their access), and Async Code processes that data on its behalf as a processor, within the meaning of article 28 of the GDPR. As such, Async Code:
The data is hosted in the European Union. A customer who wishes can request a signed data processing agreement at privacy@sharedenv.com.
For any complaint, write to hello@sharedenv.com. If you are a consumer and your written complaint has not been resolved, you can turn, free of charge and within one year of it, to the consumer mediator Async Code belongs to: [MEDIATOR: name, address, website].
The Terms of Sale are governed by French law. The "Governing law and disputes" article of the Terms of Use applies to them.