Both categories are encrypted at rest, and all traffic to and through Horizon
is encrypted in transit. This page describes the guarantees that follow: where
secret values can appear, how they reach a running server, and what Horizon
keeps them out of.
Encryption at rest
Every environment variable and connector credential is individually encrypted before it is stored, and the platform’s underlying data stores are themselves encrypted at rest.Secret handling
Dashboard and API responses
Sensitive environment variables are write-only in the dashboard after creation. Listing a server’s environment variables returns metadata only (key names, scopes, timestamps), never stored values. An environment variable’s plaintext is returned only through an explicit per-value reveal, and only to a caller whose organization access authorizes it. Connector credentials are never returned to callers. Connector listings redact client credentials, updating a connector writes a new configuration without reading the stored plaintext back, and decryption happens only server-side when Horizon authenticates to the external system on your behalf.Deployments
A hosted server receives its environment variables when Horizon builds and deploys it. A running server never reads Horizon’s secrets store, so changing or rotating a value takes effect on the next deployment, and an existing artifact keeps the values it was built with. The rotation procedure walks through replacing a credential without downtime.Logs
Platform logs record key names and identifiers, never secret values.Encryption in transit
All traffic to the Horizon dashboard and API, and to servers served through Horizon, uses HTTPS. Plain-HTTP requests are redirected to HTTPS rather than served.Security reviews
If your procurement or security review needs implementation detail beyond this page, such as key management, encryption algorithms, or infrastructure controls, contact horizon-support@prefect.io to request a formal security review.Related docs
Environment variables
Create, scope, and rotate the encrypted values your hosted servers use.
Authentication
How callers prove identity to servers and to Horizon itself.
Authorization
How roles and access grants decide what authenticated actors can do.
Gateway
How requests move through routing, authentication, and access checks.
Security and compliance
Find current reports and security review resources.