Keyward
Security

A product that holds your secrets deserves a careful design

This page says what Keyward is built to enforce, how, and where its protection ends. Keyward Server 1.0.0-alpha.1 is the first build, internal; this site's licensing, update channel and sign-in are built and tested; Keyward Desktop, the Service and the connectors are designed. The limits at the end say what has been proven, and how. We would rather you knew the limits from us than found them yourself.

Defaults

Local until you decide otherwise

A secret on your computer stays there. Anything that would send it anywhere is a feature you turn on, named for what it does, and off until then.

SettingDefaultWhy
Sync with a serverOff, per projectA computer is enrolled by you, and only the projects you choose are mirrored. The server never opens a connection to the computer.
A value in a model's contextNever without youThe default answer to an AI session is a handle. A reveal needs your approval with Windows Hello, every time, for minutes.
Telemetry and analyticsDoes not existKeyward Server runs with upstream's telemetry switched off; this site has no analytics service; the programs have none.
Network listeners on the computerNonePrograms talk to the Keyward Service over a named pipe. The relay for ChatGPT and claude.ai is an outbound connection from the Desktop, never a port.
Secrets on a command line or in a logNeverValues travel in environments, pipes and file descriptors; argv is readable by every process on a host and is never used.
Windows' own credentialsLeft aloneCredential Manager keeps what Windows needs for RDP, shares and domains. Keyward imports from it only when you ask.
A remote model inside KeywardDoes not existKeyward answers models; it does not call one.

The vault on your computer

The Keyward Service creates a key in the TPM that cannot be exported, wraps a data key with it, and encrypts the vault file under the data key with AES-256-GCM in a versioned envelope. The file is useless on another computer and on an imaged disk. Without a TPM, the service falls back to Windows' data protection and says so in every log line, never silently.

  • The vault lives in the service account's directory, with permissions to that account only
  • A reveal needs user presence through Windows Hello; the service holds the request until you answer or the lease times out

Callers, identified

A request over the pipe carries the caller's process. The service reads its image path and the image's Authenticode signature, and the user's account, and answers under the policy for that publisher and that user. A program is never believed about who it is. An unsigned caller gets references only; a caller outside the policy gets nothing.

  • Policy is per caller, per project and per tier: reference, inject, reveal, write
  • Every answer is leased and audited: who, which program, which secret, the reason given, the approval

Updates

A release is trusted through its signature and through nothing else. The manifest is signed with ECDSA P-256; the public half of the release key is compiled into each program. The installer is then checked against the size and SHA-256 in that signed manifest before it runs.

  • This site holds no key that can sign a release, and refuses to publish one that is not signed
  • The release key and the license key were generated inside a vault and have never been on a workstation or on this site
  • Only a strictly newer version is offered, so an old release cannot be replayed

Sign-in

People at Exprezoe sign in with Exprezoe Identity in place of a license key, in the browser and from a program: authorization code with PKCE, a challenge this site issued to that installation, a second factor checked where it belongs, and a sign-in no older than two minutes. No program ever sees a password. Everyone else activates an installation with a license key.

  • The answer comes back to an address on your own computer that exists only for that sign-in
  • What a program holds afterwards is an entitlement that can be revoked, in the operating system's protected storage
  • The Keyward Connector uses the same provider: OAuth 2.1, Keyward as a resource server only, tokens revocable in Identity
Privacy

What the programs send, and to whom

Neither Keyward Desktop nor the command line has analytics or usage tracking. They talk to this site for these things only.

To this siteWhat
The update channelThe installation's entitlement, which program it is and its version. The answer is the signed manifest.
The license serviceThe license key once, at activation, with the program, the computer's name, the platform, the version, and a hash of an identifier made for that installation.
Staff sign-inFor Exprezoe staff: the proof of sign-in from Exprezoe Identity, once, in place of a license key.

Never a secret, a vault, a project's contents, a caller's request or an audit line. Those go to a Keyward server only when you enrol the computer, and only for the projects you choose.

Limits

What we do not claim

  • Keyward Server 1.0.0-alpha.1 proves the server's part, not the Desktop's. What is proven: an isolated restore of a real vault with 628 of 628 cells decrypted and 7 of 7 authorization invariants, repeated weekly; this site's tests, including a forged entitlement, a replayed sign-in and a race for the last seat. The Desktop, the Service, the MCP and the connectors exist as designs with written gates, and no test has run against them because there is nothing to run it against.
  • The alpha carries upstream's enterprise paths. They are excluded from every release artifact by policy; the build that enforces it is not written. Until it is, every Keyward Server image is internal, for development and testing, and labelled so.
  • The installers, when they exist, will not be signed with a publisher certificate at first. Verify the SHA-256 shown on the downloads page before you choose to run one.
  • The programs run with your rights. They cannot protect a secret from software already running as you on your computer; they can refuse to hand it out, and they can tell you who asked.
  • A license is tied to an installation to count seats. That is bookkeeping, not a security boundary.
  • No outside party has audited Keyward. When one has, the result will be linked here.
Reporting

Found something?

Tell us before you tell anyone else, and give us the chance to fix it. Every report is read by the people who build Keyward.

Report through your contact at Exprezoe. A public address for reports will be published here and in /.well-known/security.txt.

Please include which program and its version, what you did, what happened, and what you expected. Please do not include a real secret, a vault or anything confidential.

Keyward Server 1.0.0-alpha.1 is being built; Keyward Desktop is designed

A secrets, credentials and machine-identity platform you run yourself, and a vault on your own Windows computer that gives AI sessions handles instead of secrets. In early access, licenses go to Exprezoe's staff and to the testers we invite; one license covers Keyward Desktop and the command line.

Where it stands I have a license