---
title: "Gazebo Security"
description: "Encryption, data handling, and security practices at Gazebo."
url: "https://gazebohq.com/security"
---

# Gazebo Security

## Credential encryption

Credentials are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately from the credential data. Plaintext values are never returned to the browser — only service names and connection status are exposed client-side.

## Access tokens

Each access profile generates a unique bearer token scoped to that profile. Tokens cannot be used to access other profiles, read vault metadata, or perform administrative actions. If a token is compromised, revoke it by deleting the access profile — no effect on other profiles or underlying service credentials.

## Approval controls

You can require human approval before an agent receives access for sensitive work. Gazebo enforces this control server-side; the agent performs the service action within its granted scope.

## Audit logging

Every `get_credential` call is logged with agent identity, service requested, timestamp, and outcome. Logs are append-only and scoped to the account.