> ## Documentation Index
> Fetch the complete documentation index at: https://docs.horizon.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption and data protection

> How Horizon protects environment variables and connector credentials at rest and in transit, and where secret values can appear.

Horizon stores two categories of sensitive values on your behalf:

| Category              | What it holds                                                                                                                                     | Who provides it                                           |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| Environment variables | Values a hosted server needs at build time or runtime: upstream API keys, database URLs, and similar configuration.                               | You. See [Environment variables](/environment-variables). |
| Connector credentials | Values Horizon uses to authenticate to external systems: OAuth client secrets, remote-server tokens, and the rest of a connector's configuration. | You or Horizon, depending on the connector.               |

Both categories are encrypted at rest, and all traffic to and through Horizon
is encrypted in transit. This page describes the guarantees that follow: where
secret values can appear, how they reach a running server, and what Horizon
keeps them out of.

## Encryption at rest

Every environment variable and connector credential is individually encrypted
before it is stored, and the platform's underlying data stores are themselves
encrypted at rest.

## Secret handling

### Dashboard and API responses

Sensitive environment variables are write-only in the dashboard after
creation. Listing a server's environment variables returns metadata only
(key names, scopes, timestamps), never stored values. An environment
variable's plaintext is returned only through an explicit per-value reveal,
and only to a caller whose organization access authorizes it.

Connector credentials are never returned to callers. Connector listings
redact client credentials, updating a connector writes a new configuration
without reading the stored plaintext back, and decryption happens only
server-side when Horizon authenticates to the external system on your
behalf.

### Deployments

A hosted server receives its environment variables when Horizon builds and
deploys it. A running server never reads Horizon's secrets store, so changing
or rotating a value takes effect on the next deployment, and an existing
artifact keeps the values it was built with. The
[rotation procedure](/environment-variables#rotation) walks through replacing
a credential without downtime.

### Logs

Platform logs record key names and identifiers, never secret values.

<Warning>
  Anything your own server code prints to stdout or stderr is captured as
  server logs. Keep secret values out of your server's logging statements.
</Warning>

## Encryption in transit

All traffic to the Horizon dashboard and API, and to servers served through
Horizon, uses HTTPS. Plain-HTTP requests are redirected to HTTPS rather than
served.

## Security reviews

If your procurement or security review needs implementation detail beyond
this page, such as key management, encryption algorithms, or infrastructure
controls, contact
[horizon-support@prefect.io](mailto:horizon-support@prefect.io) to request a
formal security review.

## Related docs

<CardGroup cols={2}>
  <Card title="Environment variables" icon="key" href="/environment-variables">
    Create, scope, and rotate the encrypted values your hosted servers use.
  </Card>

  <Card title="Authentication" icon="user-check" href="/platform/authentication">
    How callers prove identity to servers and to Horizon itself.
  </Card>

  <Card title="Authorization" icon="shield" href="/platform/authorization">
    How roles and access grants decide what authenticated actors can do.
  </Card>

  <Card title="Gateway" icon="route" href="/gateway">
    How requests move through routing, authentication, and access checks.
  </Card>

  <Card title="Security and compliance" icon="file-shield" href="/security/overview">
    Find current reports and security review resources.
  </Card>
</CardGroup>