Every run gets its own identity — scoped to the deploy, alive for minutes, gone after the run — and leaves a signed receipt you hold.
Almost every pipeline, given enough time, accumulates a long-lived deploy secret: an SSH key, a cloud key, a kubeconfig, parked in CI so the deploy step can reach production. It's convenient. It's also what leaks.
You set the rule once, from your own device: this repo, this branch, deploys to this box. On push, your CI job mints a short-lived OIDC token — scoped, deploy-only, expiring in minutes, with nothing static stored in CI. The deploy travels over your mesh, straight to the target, and the signed run-receipt lands in your tamper-evident ledger: run, repo, ref, scope, and the fact that the vendor was never on the data path.
A well-guarded secret is still a secret that can be taken. No secret is a different category of answer — and the receipt means your auditor reads a ledger instead of trusting a promise. On the blog: why the secret will leak → · why the owned machine is the runner →
Five minutes from install to your first signed receipt — the walkthrough is on the front page.
Does this sound like your pipeline?
Tick what's true. Nothing is sent — this is for you.
That's the door. Wire one repo to a signed, secretless deploy in five minutes — free.
Download freeReach for us when you deploy to your own infrastructure — VPS, on-prem, mixed cloud — and want the runner to hold nothing worth stealing, with a signed receipt per deploy that your auditor can read instead of trusting a promise.
Reach for someone else when you're entirely inside one cloud whose native OIDC-to-deploy already covers you end to end. And the agent / AI-script extension of this is on the roadmap, not in today's offer — we won't sell it as shipped.
One choice among several — this page exists so you can tell which one you're looking at.
We publish what this doesn't do yet, in plain words: our honest limits →