Every multi-tenant platform ends up storing things that look a lot like PHI even when they aren't — integration credentials, signing secrets, webhook tokens. We treat that material with the same discipline.
Storage: each secret is encrypted with AES-256-GCM using a per-record initialization vector and an authentication tag. The encryption key is derived from a master secret + tenant_id, so the same plaintext encrypted for two different tenants yields different ciphertexts.
Access: the underlying table has row-level security limiting reads and writes to tenant admins, verified server-side by a Postgres RPC before the secret is ever decrypted. Service-role code paths are audited and minimal.
Rotation: admins can rotate at any time; the previous ciphertext is purged. The UI surfaces only the last 4 characters to confirm a value is present, never the full secret.