The Vault: Secrets & Zero-Knowledge

The single greatest vulnerability in legacy cloud panels (like Forge or RunCloud) is how they handle your sensitive data.

Historically, if you typed a database password, an API key, or pasted an SSH private key into a cloud panel, that key was stored in plain text (or weakly hashed) in the provider's central database. If the provider was hacked, the attackers instantly gained root access to your entire infrastructure.

RasnuOS vehemently rejects this model.

The Zero-Knowledge Architecture

RasnuOS operates on a strict Zero-Knowledge security model.

• We do not take your passwords.
• We do not take your private SSH keys.
• We do not read your application's raw data or files.

We simply provide you with the orchestration engine; you retain absolute cryptographic control over your infrastructure.

HashiCorp Vault Integration

When you define a sensitive Environment Variable (e.g., STRIPE_SECRET_KEY), or when the system generates a root database password, it is never stored in the RasnuOS database in a readable format.

1. Encryption at Rest: The moment you click save, the plaintext string is sent to our highly isolated, heavily firewalled HashiCorp Vault Transit Engine.
2. Ciphertext Storage: Vault encrypts the string using an asymmetric key specific to your Organization. The RasnuOS database only stores the resulting, useless ciphertext (e.g., vault:v1:xD4...).
3. Decryption in Memory: The ciphertext is only decrypted in the ephemeral memory of the Control Plane at the exact millisecond the RasnuOS Agent requests it for a deployment.

Mathematical Guarantees

Because of this architecture, even if we wanted to, RasnuOS engineers cannot read your private keys.

A catastrophic breach of the RasnuOS central database would yield absolutely zero actionable credentials to an attacker. The data is mathematically useless without the hardware-backed encryption keys held within the isolated Vault environment.