Secrets custody: who can operate the Petsem decrypt path?

, ,
1

We’re doing a security review before moving a workload with regulated personal data to Fly. The docs say API servers “can only encrypt; they cannot decrypt secret values” and that host agents decrypt app secrets at machine boot; we also saw the June Petsem emergency maintenance.

  1. Which Fly roles/personnel can operate or invoke the host-agent decryption path for customer app secrets (directly or via tooling), and under what controls (approvals, audit logging)?
  2. Are app-secret plaintexts ever accessible outside a customer’s machine boot path (Petsem ops, debugging, incident response)?
  3. Is operator access to that path logged, and is it in scope of the SOC 2 audit?
3

Hi, thanks for your questions. For in-depth security details you’ll get best answers by sending an email to compliance@fly.io, but I can explain a little here (though I’m not familiar with the details of SOC2).

It is not possible to operate the host-agent decryption path manually without a running machine on the host created by an user. An operator cannot create a machine for this purpose without involvement from the user - it would, among other things, fail to pull secrets. Members of our Security team who operate Petsem can theoretically read plaintext secrets; this would be logged, as all operator access to Fly.io production is.