> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bluvo.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# Encryption
> How Bluvo secures exchange API keys and sensitive credentials
## Overview
Bluvo implements **enterprise-grade encryption** for all exchange API keys and sensitive credentials. Through our integration with the [@better-auth](https://better-auth.vercel.app/) API Keys plugin and our multi-tenant architecture, your exchange credentials are **encrypted at rest**, [isolated by tenant](/learn/multi-tenancy), and **protected through multiple security layers**.
## Motivation
Exchange API keys represent **direct access to funds** and require exceptional security. Unlike typical API credentials, crypto exchange keys:
* Can authorize trading operations and withdrawals if compromised
* Are typically long-lived and don't always support automatic rotation
* Provide broad permissions that are difficult to scope down
* Are targeted specifically by sophisticated attackers
Once exchange credentials are leaked, **the damage is immediate and often irreversible**. This reality creates additional challenges:
* Securing keys while maintaining high-performance access
* Preventing lateral movement between customer environments
* Meeting regulatory requirements for data protection
* Providing cryptographic proof of isolation for audits
Bluvo's encryption architecture solves these problems with a comprehensive approach that provides **defense in depth** for your most sensitive credentials.
## Implementation
### Key Storage Strategy
Every API key in Bluvo is protected through a multi-layered approach:
```javascript theme={null}
// Example of how Bluvo stores API keys (simplified)
const storedCredential = {
exchangeId: 'binance',
encryptedApiKey: 'AES256.XXXX...', // encrypted with tenant-specific key
encryptedSecret: 'AES256.XXXX...', // encrypted with tenant-specific key
iv: 'XXXX...', // Initialization vector
createdAt: '2023-04-17T10:20:30Z',
lastUsed: '2023-04-17T10:20:30Z',
permissions: ['trade', 'read']
}
```
Each credential is:
1. **Encrypted** using AES-256-CBC with a unique initialization vector
2. **Stored** in your isolated tenant database
3. **Accessed** only through authenticated API requests
4. **Decrypted** in memory only when needed for exchange operations
### Better-auth API Keys Plugin
Bluvo leverages the [@better-auth](https://better-auth.vercel.app/) API Keys plugin which provides:
* **Secure key generation** following cryptographic best practices
* **Automatic encryption** of sensitive values
* **Access control** through fine-grained permissions
* **Activity logging** for security monitoring
This ensures that API keys are protected with the same level of security that would be applied to passwords and user credentials.
### Tenant-Specific Encryption Keys
In addition to our multi-tenant database architecture, we also employ **tenant-specific encryption keys**:
* Each customer has a **unique encryption key** that is isolated from other tenants
* Encryption keys are **stored separately** from the encrypted data
* Key material is **never logged** or exposed in error messages
This ensures that even in a hypothetical breach scenario, one tenant's encryption keys cannot decrypt another tenant's data.
### Encryption Key Management
Bluvo implements best practices for encryption key management:
* **Key hierarchy** with master keys and data encryption keys
* **Access control** limiting key access to essential services
All encryption operations follow the **principle of least privilege**, ensuring that decryption happens only when absolutely necessary.
## How It Works
When one of your customers connects a wallet to Bluvo, the following steps occur:
1. **Organization Identification**: We identify the organization behind the Bluvo API Key
2. **Project Authentication**: We identify the project and verify the API Key has wallet connection permissions
3. **Exchange Validation**: We validate your exchange API keys with a test interaction
4. **Encryption Process**: We encrypt your exchange credentials using node:crypto aes-256-cbc following latest patched best practices
5. **Secure Storage**: We store your API keys at rest in an encrypted format using the tenant-specific encryption key
This architecture provides **defense in depth** through multiple security layers:
1. **Authentication layer** ensures only authorized users access the system
2. **Tenant isolation** restricts access to your specific database
3. **Encryption layer** protects the actual credential values
4. **Key isolation** ensures tenant-specific encryption keys
5. **Memory protection** prevents persistence of decrypted values
## Security Features
The [@better-auth](https://better-auth.vercel.app/) API Keys plugin provides additional security capabilities:
* **Key rotation** for regularly updating credentials
* **Permission scopes** for limiting access to specific operations
* **Usage analytics** for monitoring suspicious activities
* **Revocation** for immediate credential invalidation
## Multi-Layer Security Shield
Bluvo doesn't just encrypt your data; it wraps it in multiple layers of battle-tested protection that work together to create an impenetrable security shield.
### Next-Gen Session Management
Your sessions aren't just stored; they're protected by a complete security system:
* **Zero-knowledge session storage** in dedicated tenant databases
* **Intelligent expiration** that adapts to user behavior and risk profiles
* **One-click revocation** for immediate response to security events (you can just delete an API key and all sessions will be invalidated)
* **Automatic token refresh** minimizes the need for re-authentication
## The Multi-Tenant Advantage
What makes Bluvo's approach to encryption truly unique is how it integrates with our multi-tenant architecture. This isn't just another security feature; it's a fundamental design principle.
```javascript theme={null}
// Tenant isolation in action
const decryptCredentials = async (encryptedData, tenantId) => {
// Each tenant has its own encryption key that can ONLY
// decrypt their own data
const tenantKey = await keyManager.getTenantKey(tenantId);
return decrypt(encryptedData, tenantKey);
};
```
* **True tenant isolation** keeps your data in separate databases with separate encryption keys
* **Cryptographic boundaries** ensure that even in worst-case scenarios, breaches can't cross tenant lines
* **Global consistency** maintains identical security standards across all geographic regions
This combination creates both **logical and cryptographic separation** between tenants; a security approach that requires multiple simultaneous compromises to breach.
## Benefits
On a technical level, Bluvo will:
* **Eliminate hundreds of lines** of complex security code from your codebase
* Make your exchange integrations **secure by default** without constant monitoring
* Have a **direct impact** on compliance audits and security certifications
* **Transform incident response** through tenant isolation and comprehensive audit trails
## Security That Works For You
Rather than building yet another security system that gets in your way, Bluvo's security features are designed to enhance your workflow:
* **Zero plaintext storage** of sensitive credentials \\
* **Complete tenant isolation** through cryptographic boundaries \\
* **Defense in depth** that protects against multiple attack vectors \\
* **Developer-friendly API** that abstracts away security complexity \\
* **Comprehensive logging** for security auditing and compliance \\
All encryption, decryption, and security controls happen automatically.
## Next Steps
Ready to learn more about Bluvo's security features?
* [Get your API Keys →](https://portal.bluvo.dev)
* [Schedule a Call →](https://cal.com/bluvo/30min)