Your secrets, governed.
Compliance you can see from CI.
Clef Pro is the hosted governance dashboard for the Clef CLI. See encryption metadata, track key rotation, enforce policies — without ever touching ciphertext.
Quick-start guides, CLI reference, and integration docs to help security teams set up governance and start tracking compliance in minutes.
Install. Report. Govern.
Add one CI step and get a complete secrets governance dashboard in minutes.
Install Clef, initialise your repo, and manage encrypted secrets with Mozilla SOPS. Clef works with age, PGP, AWS KMS, GCP KMS, and Azure Key Vault.
Run
clef report
in your pipeline. Clef sends encryption metadata — key types, rotation timestamps, recipient
fingerprints — never ciphertext or decrypted values.
The namespace x environment grid shows rotation age, recipient count, and policy compliance for every encrypted file. Alerts fire when keys are overdue or missing.
Why Clef Pro?
Governance without custody. See everything, touch nothing.
Namespace x environment grid showing every encrypted file, its key type, recipient count, and compliance status — updated on every CI run.
See when every key was last rotated. Get alerted when rotation policies are violated — before an auditor asks.
Define governance rules — max rotation age, required key types, minimum recipients — and enforce them automatically on every report.
See exactly who has access to each secret file via their encryption key fingerprints. No more guessing who can decrypt what.
One
clef report
step in GitHub Actions, GitLab CI, or any pipeline. Reports flow in automatically on every push.
Clef Pro never sees ciphertext or decrypted values. Only encryption metadata flows to the dashboard — your secrets stay in your repo.
The CLI is free. The dashboard is worth paying for.
Clef CLI and runtime agent are open source and always free. Clef Pro adds the governance UI your team and auditors need.
- Lint, drift, and report commands
- Runtime secret delivery (VCS API + age)
- SOPS encryption & key management
- Push to any OTLP-compatible backend
- CI/CD integration (GitHub Actions, etc.)
- Governance dashboard
- Secret file matrix (namespace x env)
- Cross-repo health & drift view
- Alert notifications (email + webhook)
- 1-year report & OTLP retention
- Team RBAC (5 roles)
- CSV + PDF export
- Unlimited report history
- SOC 2 compliance export
- SSO (SAML / OIDC)
- Custom retention policies
- Dedicated support
- SLA
Ready to govern your secrets?
Clef Pro gives your team a single, live view of every encrypted secret file — with compliance status built in. No ciphertext ever leaves your repo.
Open Clef Pro