What is STACKIT Secrets Manager?
STACKIT Secrets Manager is a fully managed service for secure storage of sensitive data such as API keys, passwords, certificates, and configuration parameters. All secrets are encrypted with AES-256-GCM and keys are managed via STACKIT KMS. The service runs exclusively in German data centers for complete GDPR compliance.
Core Features
- AES-256-GCM encryption at rest
- Automatic versioning of all secret changes
- Configurable automatic rotation for credentials
- Granular access control via STACKIT IAM
- Complete audit logging of all access
Typical Use Cases
Database Credentials for Microservices: Instead of storing passwords in environment variables, credentials are retrieved from Secrets Manager at runtime. Automatic rotation ensures regular credential changes.
API Keys for External Services: Payment providers, email services, and cloud APIs require API keys. Secrets Manager stores these encrypted and versioned for quick rollback.
TLS Certificates and Private Keys: Centralized certificate management with expiration notification and automated rotation via Certificate Authorities.
Benefits
- Complete data sovereignty in German data centers
- Automatic versioning for quick rollback
- Integration with Kubernetes, Terraform, and CI/CD pipelines
- GDPR compliant with complete audit trail
Integration with innFactory
As an official STACKIT partner, innFactory supports you with STACKIT Secrets Manager: architecture, migration, operations, and cost optimization.
Available Tiers & Options
Standard
- 10,000 secrets
- Automatic rotation
- Versioning
- Standard API rate limits
Typical Use Cases
Technical Specifications
Frequently Asked Questions
How are secrets encrypted?
Secrets are encrypted at rest using AES-256-GCM. Encryption keys are managed via STACKIT KMS. TLS 1.3 is used during transmission.
Can I rotate secrets automatically?
Yes, for database credentials and API keys you can define rotation intervals that automatically generate new credentials and invalidate old versions.
How do applications access secrets?
Via REST API, SDKs, or Kubernetes integration. Workload Identity enables pods to access secrets directly without hardcoded credentials.
Is STACKIT Secrets Manager GDPR compliant?
Yes, the service operates exclusively in German data centers. STACKIT provides data processing agreements and is ISO 27001 certified.
