Security review, answered
An API client sees your staging tokens, your production headers and your customers’ payloads. It is reasonable for a security team to have questions about it.
SOC 2, encryption and audit logs
Requestly holds SOC 2 Type II certification, which covers the controls around how data is handled, who can reach it, and how that is monitored over time. Data is encrypted in transit and at rest.
SSO and role-based access
SAML single sign-on integrates with your existing identity provider — setup is documented for Okta and Microsoft Entra ID. Inside a shared project, role-based access control assigns Admin, User or Viewer, so edit rights follow responsibility. Audit logs record activity across your organization’s workspaces.
Where secrets actually live
The controls above matter, but so does the everyday path a credential takes. Two things are worth knowing:
- Vault encrypts secrets through the operating system keychain and stores only a
{{vault:key}}reference in the collection. The value never appears in an export, in console output, or in cloud sync. - Local projects keep an individual’s collections and environments on their own machine, with nothing synced at all.
Together those mean a shared collection can be genuinely shareable without the credentials riding along.
