Overview
Two-factor authentication
TOTP-based 2FA works with Google Authenticator, Authy, and 1Password. An organization can require it: members without 2FA cannot access API keys until they enable it.Immutable audit log
Every access and change is recorded. The audit table is append-only: a database trigger prevents all updates and blocks deletion of records from the last 90 days. An attacker cannot erase recent traces. Older rows are removed automatically according to the retention policy.Trust model
Elding encrypts API keys at rest and serves them over HTTPS. The server decrypts them for
delivery to the proxy. This is a managed model rather than strict zero knowledge. Elding
does not handle non-HTTP secrets. The client-side promise still holds: API keys never touch
your disk or your application’s memory when using the proxy.