Use case

There is no 'download the spreadsheet' path

Keystacker exports are encrypted by design, scoped to authorized roles, and recorded — so secrets never leave the system as plaintext.

There is no unencrypted secret export path.

Encrypted-only export pathway

There is no unencrypted export option. Authorized exports are encrypted and recorded in the audit trail.

Only operators with explicit permission can initiate exports. Read-only and standard technician roles cannot.

Every export is captured with actor, scope, and timestamp — ready for auditors without screenshots or reconstructions.