Docs your AI can read.
Secrets it can’t.
Keddaro renders Markdown straight from your repositories and encrypts restricted sections, so people read only what they’re cleared for and agents never get the restricted text.
Use this runbook when the primary database region degrades. The on-call engineer owns the decision; seniors perform the promotion.
Confirm the incident channel is open, the status page is updated and a second engineer is on the call.
Promote the standby in the secondary region, then verify it accepts writes before updating the connection string.
failover promote --region eu-west-2 failover verify --writes --timeout 120s
Use this runbook when the primary database region degrades. The on-call engineer owns the decision; seniors perform the promotion.
Confirm the incident channel is open, the status page is updated and a second engineer is on the call.
Sealed per block. Each restricted block is its own ciphertext, under its own key.
Signed in place. A block opens only in the repository and file it was sealed for.
Audited per reveal. Who, which block, which file and from where. Always.
Write it.
Commit it.
Read it by role.
Docs stay Markdown in your repository. Sealing is one save in VS Code or one command in the terminal.
Write in Markdown
Wrap anything sensitive in a restricted block and name the policy that can read it.
Seal, then commit
The server encrypts each block into its own ciphertext and signs it. A pre-commit hook refuses anything still in plaintext.
Read by role
Keddaro opens a block only for readers its policy admits. Everyone else gets a placeholder.
Everything to keep docs safe,
not hidden.
Built for engineering teams who keep runbooks, keys and policies next to the code.
A clearance ladder your teams already understand
Map GitHub teams to roles once. A policy can admit a role and every role above it, so what seniors read, admins and owners read too.
Every reveal, audited
Who opened which block, in which file and from where. Filter it, export it, hand it to your auditor.
Keys never leave the server
Each organisation’s master key lives in Azure Key Vault. Working keys are held in memory for a few minutes, never on disk. Plaintext is never stored.
Diffs that stay sealed
Git history shows which block changed, never what it says. Save a block unchanged and there is no diff at all.
PR checks that guard the rules
No plaintext in restricted blocks, no forged or hand-edited ones, none moved from where it was sealed. Every push is checked too.
Security by design,
not by policy.
Restricted content is encrypted before it reaches Git and only decrypted for people who are cleared, one block at a time.
Read the security modelEnvelope encryption
Every block has its own data key, wrapped by its policy’s key, wrapped by your organisation’s master key in Azure Key Vault.
Signed blocks
Keddaro signs each block for its repository, file and policy, and checks the signature before opening it.
Least privilege
Roles follow your GitHub teams, kept in sync every hour. Every other grant is explicit and logged.
Complete audit trail
Every read, save and refusal is recorded with who, which block and from where, in a hash chain anchored outside the database.
Simple pricing that scales
with your team.
| Start free. Upgrade when more repos and roles need sealing. | |||
| Repositories | Up to 5 | Unlimited | Unlimited |
| Roles | 3 | Unlimited | Unlimited |
| Audit log | 90 days | 1 year | 2 years |
| PR checks | Included | Included | Included |
| Bring your own Key Vault | Not included | Not included | Planned |
| Priority support and SLA | Not included | Not included | Included |
| Security review | Not included | Not included | Included |
Start sealing your
docs today.
Connect GitHub, install the app and seal your first runbook in minutes.
Uses your existing GitHub org teams.
No new passwords, no plaintext stored.