Frequently asked questions

Cremit Platform is a Non-Human Identity (NHI) security platform. It scans GitHub, GitLab, Bitbucket, GitHub Packages, AWS S3, Google Drive, Jira, Confluence, Notion and Slack for exposed API keys, service-account credentials, database credentials, SSH keys and access tokens, then verifies each finding live against the issuing service so you see which ones still work. Every live finding shows its owner and blast radius and is routed to a person through incidents and alerts. Cremit does not rotate or revoke anything; your team does that in the issuing service.

Plans and current prices live in the product rather than on this site, because which one fits depends on how much you actually scan. Start on the free plan, connect a source, and the comparison sits next to your own numbers. Larger deployments that come with a security review or their own procurement process are usually quicker to work out over email: sales@cremit.io.

Cremit scans your connected repositories and other sources on a schedule for hardcoded secrets. GitHub pull requests are also scanned as they arrive, through the GitHub App webhook. Each finding is verified against the issuing service. If it is live, Cremit opens an incident and alerts your team in Slack, a webhook, Telegram or email.

Cremit supports GitHub, GitLab, and Bitbucket, including GitHub Enterprise and GitLab Self-Managed. Authentication is via OAuth or Personal Access Token (PAT), and you can connect all repositories in an organization at once.

Cremit does not store your source code. Code is read during scanning to analyze secret patterns, but the original code is immediately discarded after processing. Cremit keeps each finding’s location, secret type and verification status, plus the credential value itself encrypted with AWS KMS (optionally under your own customer-managed key), because re-verification needs it.

Go to Dashboard > Settings > Team Management, enter the email address, select a role (Admin, Member, or Viewer), and an invitation email will be sent. Enterprise plans support SCIM auto-provisioning via Okta, Azure AD, and Google Workspace.

Email support@cremit.io, or use the chat inside the product once you are signed in. Response targets by severity are listed on the support page. Customers on an enterprise agreement have a named contact, and the response times written into that agreement.

Yes, and the free plan does not ask for a card. Connect one repository or bucket and the first scan tells you more about whether this fits than a feature table would. Plans and current prices sit in the product next to your own usage, so you can see which one you would land on before deciding anything.

Both exist, and the terms for each are shown at checkout in the product. Monthly is the easier place to start while you find out what your scan volume looks like. Nothing about that choice is locked, and you can move later.

Cremit does not rotate or revoke credentials. It tracks each credential through its lifecycle: when it was found, whether it still authenticates (re-verified every 10 minutes), how old it is against your rotation-age policy (AWS Secrets Manager, read-only, default 90 days), and who owns it. When a credential’s owner has left, SCIM 2.0 or Google Workspace directory sync flags it as a Ghost Key and routes it to a person, who rotates or revokes it in the issuing service.

AWS and GCP can be connected for permission (blast radius) analysis of AWS access keys and GCP API keys. AWS S3 buckets are a scan source, and AWS Secrets Manager can be connected read-only to report which stored secrets are live, unused, past their rotation age, or also present in code. Azure is not supported today.

Data is encrypted in transit (TLS 1.2 or higher) and at rest. Stored credential values are encrypted with AWS KMS, and you can bring your own KMS key so those values are encrypted under a key you control.

Enterprise plans support SAML 2.0-based SSO. Compatible with major IdPs including Okta, Azure Active Directory, Google Workspace, and OneLogin. Configure SSO from Dashboard > Settings > Security > SSO.

You can get started in minutes with no agents to install and no complex configuration. Simply connect your source code repositories (GitHub, GitLab, Bitbucket) and scanning begins immediately. AWS (via a CloudFormation template) and GCP (via a service account) can be connected for permission analysis in a few minutes using the step-by-step guides.

From Settings, Subscription, at any time. Cancelling keeps the service running to the end of the period you have already paid for, and we do not refund partway through one.

Identity Inventory catalogs every credential Cremit finds across your connected sources (API keys, service-account credentials, tokens) with its verification status and owner, and for AWS access keys and GCP API keys, its permissions. Live credentials are re-verified every 10 minutes, so you can see which ones still authenticate and which are stale or past their rotation age.

Go to Dashboard > Integrations > Slack, connect your workspace, and select the notification channel. You can configure separate channels for different severity levels (Critical, High, Medium, Low), and notification types are fully customizable.

Not at this point. We have not been through a SOC 2 audit, and saying so is more useful to your review than an answer you would have to verify later. What does exist is the security whitepaper: where data is stored, who can read it, how customer-managed KMS keys work, and what happens on deletion, documented as implemented rather than as intent. If your review needs specific evidence, write to compliance@cremit.io and we will tell you plainly whether we can provide it.

Click "Forgot your password?" on the login page and enter your registered email. A password reset link will be sent to you. The link is valid for 15 minutes. If you don't receive the email, check your spam folder or contact support@cremit.io.

Cremit detects 1,000+ secret types. This includes API keys, OAuth tokens, JWTs, SSH private keys, database connection strings, cloud credentials (AWS, GCP, Azure), Stripe/payment keys, and Slack/collaboration tokens. Findings are checked against the service that issued them, so what reaches your team is the set that still authenticates.

If there is a security review, procurement paperwork, SSO and SCIM, or a scope that does not fit the standard plans, email sales@cremit.io. Team size, the sources you would connect, and any compliance requirements are enough for a first reply you can actually use.

Every finding is checked against the service that issued the credential before it reaches you, so one that was revoked months ago does not arrive looking like a live one. For the cases that keep coming back you can allowlist a pattern or a path, and marking something as a false positive feeds back into detection.

Jira is a scan source: Cremit scans issues and comments for exposed credentials. Alerts go to Slack, a webhook, Telegram or email. Creating or syncing Jira tickets is not a built-in action today, but the webhook and REST API can feed your own tracker.

Cremit provides a Data Processing Agreement (DPA) and handles the data it processes in line with GDPR and Korea’s PIPA (Personal Information Protection Act). For DPA or data processing inquiries, contact privacy@cremit.io.

Not today. Cremit scans GitHub, GitLab, Bitbucket, GitHub Packages (including GHCR images), AWS S3, Google Drive, Jira, Confluence, Notion and Slack. Kubernetes cluster scanning is not available.