mirror of
https://github.com/Infisical/infisical.git
synced 2026-05-02 03:02:03 -04:00
57 lines
3.2 KiB
Plaintext
57 lines
3.2 KiB
Plaintext
---
|
|
title: "Preface"
|
|
---
|
|
|
|
Each project in Infisical can be used either in **End-to-End Encrypted (E2EE)** mode or **Encrypted Standard (ES)** mode which dictates how it can be interacted with via the Infisical API.
|
|
|
|
<CardGroup cols={2}>
|
|
<Card
|
|
title="Encrypted Standard (ES)"
|
|
href="/api-reference/overview/encryption-modes/es-mode"
|
|
icon="shield-halved"
|
|
color="#3c8639"
|
|
>
|
|
Secret operations without client-side encryption/decryption
|
|
</Card>
|
|
<Card href="/api-reference/overview/encryption-modes/e2ee-mode" title="End-to-End Encrypted (E2EE)" icon="shield" color="#3775a9">
|
|
Secret operations with client-side encryption/decryption
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
By default, all projects are initialized in **E2EE** mode which means the server is not able to decrypt any values because all secret encryption/decryption operations occur on the client-side. However, this has limitations around functionality and ease-of-use:
|
|
|
|
- You cannot make HTTP calls to Infisical to read/write secrets in plaintext.
|
|
- You cannot leverage non-E2EE features like native integrations and in-platform automations like dynamic secrets and secret rotation.
|
|
|
|
For this reason, Infisical also provides the **ES** mode of operation to unlock the above limitations by enabling the server to decrypt your values. You can optionally switch a project to using **ES** mode
|
|
in your Project Settings.
|
|
|
|
<Note>
|
|
Make no mistake, the limitations of **E2EE** mode do not prevent you from syncing secrets from Infisical to platforms like GitLab. They just imply
|
|
that you have to do things the "E2EE-way" such as by embedding the Infisical CLI into your GitLab CI/CD pipelines to fetch and decrypt
|
|
secrets on the client-side.
|
|
</Note>
|
|
|
|
## FAQ
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Is E2EE mode or ES mode right for me?">
|
|
We recommend starting with **E2EE** mode and switching to **ES** mode when:
|
|
|
|
- Your team needs more power out of non-E2EE features available in **ES** mode such as secret rotation, dynamic secrets, etc.
|
|
- Your team wants an easier way to read/write secrets with Infisical.
|
|
|
|
</Accordion>
|
|
<Accordion title="How can I switch from E2EE mode to ES mode?">
|
|
By default, all projects in Infisical are initialized to **E2EE** mode and can be switched to **ES** mode in the Project Settings by disabling end-to-end encryption.
|
|
</Accordion>
|
|
<Accordion title="Is ES mode secure if it's not E2EE?">
|
|
**ES** mode is secure and in fact what most vendors in the secret management industry are doing at the moment. In this mode, secrets are encrypted at rest by
|
|
a series of keys, secured ultimately by a top-level `ROOT_ENCRYPTION_KEY` located on the server.
|
|
|
|
If you're concerned about Infisical Cloud's ability to read your secrets if using **ES** mode in Infisical Cloud, then you may wish to
|
|
use Infisical Cloud in **E2EE** mode or self-host Infisical on your own infrastructure and then use **ES** mode; this of course which means setting up firewalls and securing the instance yourself.
|
|
|
|
As an organization, we prohibit reading any customer secrets without explicit permission; access to the `ROOT_ENCRYPTION_KEY` is restricted to one individual in the organization.
|
|
</Accordion>
|
|
</AccordionGroup> |