Cloud applications often require access to secret credentials, such as API keys. When you deploy a service on Render, you usually store those application secrets in environment variables.
Protection of application secrets is a shared responsibility. We handle safeguards for Render’s core infrastructure while providing you with tools to secure credentials at the application layer. This post provides a quick summary of what we do—and what you can do to help stay safe.
* For a deeper look at Render’s security program and how we safeguard the platform, download our whitepaper Security at Render: Program and Platform from your Document Center in the Render Dashboard.
What Render does
Encryption in transit and at rest
All of your services’ environment variables and secret files are encrypted with AES-256 when stored on Render. All traffic to the Render Dashboard and API uses TLS 1.2 or later.
Tightly controlled staff access
Access to our production infrastructure requires single sign-on. Privileged access uses just-in-time grants that expire automatically.
Whenever a member of our team supports a customer, they use internal tooling with strict controls:
- Restricted by role: Only staff who support our customers receive this access at all, and elevated access requires additional approval.
- Justified: Every privileged access session requires a documented reason that is logged and audited.
- Time-limited: Access expires automatically after a short window.
Detection and response
Our security team continually monitors the platform and internal activity through our SIEM (security information and event management) system. We run a 24/7 security on-call rotation, with trained responders ready to activate our security incident process.
We regularly detect attempts to access Render accounts using credentials exposed in data breaches at other organizations. We have tooling in place to shut down this malicious activity and contact potentially affected customers. Learn more in this blog post.
Vulnerability management
We assess our applications and infrastructure through both annual human-led penetration tests and continuous AI-powered testing. Critical findings are prioritized for urgent review and remediation.
What you can do
Monitor access and changes to secrets
Render audit logs record team member actions that might expose sensitive credentials. This includes viewing or modifying environment variables and opening a shell session to a running service. Render retains at least the last 90 days of your workspace’s audit log events.
We recommend that you export audit logs as a CSV or pull them with our REST API to alert on unexpected activity using your security tooling.
Limit privileged access to your workspace
Limit the number of workspace admins and set up routine access reviews. Designate your production environment as protected so that only admins can perform actions that expose credentials.
Enable 2FA everywhere, and enforce it on Render
Turn on two-factor authentication for every account that touches your infrastructure, including Render. Workspace admins can enforce 2FA so members can't access resources or use API/SSH keys until they enable it.
With a Scale or Enterprise plan, set up domain ownership for SAML SSO and SCIM.
Prefer short-lived credentials
Wherever possible, use OIDC instead of long-lived access keys stored as environment variables. Render currently supports OIDC for AWS, GCP, Anthropic, and OpenAI.
Scope API keys
Give each key exactly the permissions it requires, and no more. Set spend limits on AI credentials. Where possible, scope each sensitive credential to a single service, instead of sharing between multiple applications.
Omit secrets from all logs
Never print secret values to stdout or stderr, whether at build time or runtime. Anything logged by your app is stored as plain text. For more, see our guide on how Render handles secrets and environment variables.
Keep secrets out of your repo
Never commit .env files, Render API keys, or other sensitive credentials to source control, even if your repo is private.
In your Blueprint YAML files, apply sync: false to all sensitive environment variables to enter their values securely in the Render Dashboard or CLI.
Rotate regularly
Rotate long-lived credentials on a regular schedule—at least once a year. If a credential might have been exposed anywhere (even internally), rotate it as soon as possible.
We know you trust Render with more than secrets: the workloads you run here power your products, serve your customers, and support your business. We take that responsibility seriously, and we remain fully committed to securing the platform and safeguarding the secrets your workloads depend on.