Skip to content
Datastruct
DATASTRUCT Docs

Credential security

How Datastruct stores, isolates, and uses credentials for external data vendors

When Datastruct stores an application programming interface (API) credential for a data vendor, the credential is kept outside application code, databases, and configuration. Each credential is stored as an individual secret in AWS Secrets Manager, a vault service for sensitive values.

Storage and encryption

AWS Secrets Manager encrypts each secret at rest with AWS Key Management Service (AWS KMS). Connections to Secrets Manager use Transport Layer Security (TLS), which protects the credential in transit.

Datastruct systems persist the secret’s name rather than its value. The stored credential value remains in Secrets Manager. The Data Serve service retrieves it into memory only when it needs to make an authorized vendor request.

Credential isolation

Secret names separate credentials by environment, AWS region, organization, vendor product, and individual credential. A credential belongs to one organization and is not pooled or shared with another customer.

This structure makes the organization boundary part of credential resolution, not only an application convention.

Runtime access

At runtime, only the Data Serve service’s AWS Identity and Access Management (IAM) role can retrieve vendor secrets. The role can read a secret’s value and metadata only within the Data Serve secret namespace for that environment. Other applications, pipelines, and services do not receive runtime read access to that namespace.

Credential use during an API request

Every Data Serve request must include a valid machine-to-machine token and workflow identifier. Authentication happens before Data Serve resolves a vendor credential.

The validated token identifies the caller’s organization. Data Serve does not accept an organization identity from the request body. The organization and workflow determine which credential path the service can resolve, so a caller cannot select another organization’s stored credential.

Data Serve uses the credential server-side to call the vendor. A stored secret value is not included in the API response, and request logs redact credential material.

This protection applies to credentials stored by Datastruct. Sending vendor credential fields directly in an API request has different response and logging considerations. See the source configuration reference before using that option.

Operational guardrails

Credentials enter Secrets Manager through a controlled operator process. They are never committed to source control. Secret deletion uses a seven-day recovery window by default, allowing an accidental deletion to be reversed during that period.