How Safe Archive stores archive credentials
See how S3 keys and Google tokens are kept out of job files, reports, logs, and telemetry while the archive runs on your desktop.
Safe Archive guide
Keep the copy, keep the context, and keep a record of what arrived.
Founder of ARCED Foundation, ARCED International, and Solutions of Things Lab (SoTLab). Built FolderManifest to help teams protect file integrity and stay audit-ready.
Published August 20, 2026
Scope first
Decide what you are allowed to copy before starting the archive.
Copy second
Use a destination that will remain available after access changes.
Verify last
Keep a report that names the files copied, converted, skipped, or failed.
Quick answer
Safe Archive keeps S3 secret keys and Google authorization out of job files, manifests, reports, logs, and telemetry. The desktop workflow stores credentials in the operating system keychain and resolves them when the archive runs.
1. Use the operating system keychain
S3-compatible destinations need access credentials, and Google Drive needs authorization. Safe Archive stores those secrets through the operating system keychain instead of writing the secret itself into the archive configuration.
- Windows Credential Manager
- macOS Keychain
- The Linux desktop secret store
The archive job uses an opaque reference to find the credential. The reference is not the secret and does not give another machine access by itself.
2. Keep archive jobs portable without copying secrets
A job can describe its source, destination, prefix, and archive options without embedding a secret key or token. If another operator runs the job, that person still needs an authorized account or credential reference on their own device.
This separation makes the archive settings easier to review and reduces the chance that a job file becomes an accidental credential bundle.
3. Resolve credentials only while the job runs
At runtime, Safe Archive resolves the credential reference and uses it for the selected destination. The secret does not travel into the manifest, HTML report, CSV report, logs, or telemetry.
Keep the archive report with the data, but keep credentials in the keychain and access them through the approved account process.
4. Check the credential boundary during handoff
- Confirm the receiving operator has approved access to the destination.
- Do not paste secret keys or tokens into the handoff note.
- Share the bucket, prefix, or Drive location separately from the credential process.
- Review the archive report for files and statuses, not for secrets.
The folder handoff checklist covers the access and evidence details that should travel with the archive.
Make the archive reviewable
FolderManifest copies the folder locally or to a supported destination, then creates a report with the files that arrived and the files that need attention.
Frequently asked questions
Where does Safe Archive store S3 secret keys?
S3 secret keys are stored in the operating system keychain and referenced by an opaque handle. They do not travel into the job file, manifest, report, logs, or telemetry.
Where are Google Drive tokens stored?
Google Drive authorization is stored through the desktop credential flow and referenced by the archive job. The token itself is not placed in the job file, report, logs, or telemetry.
Does telemetry contain archive credentials?
No. Archive telemetry is bucketed and does not contain secret keys, tokens, file names, paths, bucket names, prefixes, or account emails.