Frequently asked questions

Cremit Platform scans supported connected sources for exposed credentials. It checks current validity with the issuer for supported types; other findings require manual review.

Findings retain their source locations. Where available, the platform shows access context for supported AWS access keys and GCP API keys, plus ownership signals. A source author or suggested candidate is not automatically the current responder.

Cremit records alerts and response status. A person confirms ownership and rotates or revokes the credential at its issuer; Cremit does not do that automatically.

View plans and public pricing. You can also estimate costs for your scan volume.

Start on the free plan, connect a source, and the comparison sits next to your own numbers.

Larger deployments that come with a security review or their own procurement process are usually quicker to work out over email: sales@cremit.io.

Cremit scans your connected repositories and other sources on a schedule for hardcoded secrets. GitHub pull requests are also scanned as they arrive, through the GitHub App webhook.

Findings of supported types are verified against the issuing service; types without an automatic check are marked for manual review. If a finding is live, Cremit opens an incident and alerts your team in Slack, a webhook, Telegram or email.

Cremit supports GitHub, GitLab, and Bitbucket, including GitHub Enterprise and GitLab Self-Managed.

Authentication is via OAuth or Personal Access Token (PAT), and you can connect all repositories in an organization at once.

Cremit does not store your source code.

Code is read during scanning to analyze secret patterns, but the original code is immediately discarded after processing.

Cremit keeps each finding’s location, secret type and verification status, plus the credential value itself encrypted with AWS KMS (optionally under your own customer-managed key), because re-verification needs it.

In organization settings, open Members and invite a person by email. The invitation form offers Admin, Member, and Guest roles. Directory sync can provision users through SCIM 2.0 push with a compatible identity provider, or through Google Workspace API pull. Google Workspace is not a SCIM push connection. Availability depends on your organization’s plan and configuration.

Email support@cremit.io, or use the chat inside the product once you are signed in.

Response targets by severity are listed on the support page. Customers on an enterprise agreement have a named contact, and the response times written into that agreement.

Yes, and the free plan does not ask for a card. Connect one repository or bucket and the first scan tells you more about whether this fits than a feature table would.

View plans and public pricing. You can also estimate costs for your scan volume.

Both exist, and the terms for each are shown at checkout in the product.

Monthly is the easier place to start while you find out what your scan volume looks like. Nothing about that choice is locked, and you can move later.

Cremit records where a credential was found, available validity and access context, ownership signals and response status. Supported active credentials are re-verified about every six hours. Rotation-age reporting applies to connected AWS Secrets Manager records, not every credential in the inventory.

The Ghost Key checklist flags an active or manually active credential found in material authored by a person marked inactive in a connected directory. That author may not be the current owner. Confirm the responder and act at the issuer; Cremit does not rotate or revoke the key.

AWS S3 is a scan source, and AWS Secrets Manager can be connected read-only for inventory and rotation-age context. AWS access keys and GCP API keys support access analysis when the relevant integration and key type are available.

Credential patterns from Azure services may be detected in a supported connected source. Cremit does not currently provide an Azure permission-analysis connector or Azure cloud inventory. Detection of a string is not proof that the credential is valid or that all of its permissions are known.

Data is encrypted in transit (TLS 1.2 or higher) and at rest.

Stored credential values are encrypted with AWS KMS, and you can bring your own KMS key so those values are encrypted under a key you control.

Enterprise plans support SAML 2.0-based SSO.

Compatible with major IdPs including Okta, Azure Active Directory, Google Workspace, and OneLogin.

Configure SSO from Dashboard > Settings > Security > SSO.

Setup time depends on the source, account permissions and amount of data. Supported sources can be connected without installing an agent; an administrator may still need to authorize access.

Scanning follows the connector and its schedule after the connection succeeds. AWS and GCP access analysis needs separate authorization. A fixed time to the first finding cannot be promised.

From Settings, Subscription, at any time.

Cancelling keeps the service running to the end of the period you have already paid for, and we do not refund partway through one.

Identity Inventory brings together credentials found in supported connected sources, read-only AWS Secrets Manager records and manual entries. A finding can have an assigned owner, a suggested candidate or no owner. Supported types have issuer-side validity results; others need manual review.

Available AWS access-key and GCP API-key access context helps investigate scope. AWS Secrets Manager rotation age is a separate signal. Supported active credentials are re-verified about every six hours; a source-file date alone does not establish when a key was issued.

Go to Dashboard > Integrations > Slack, connect your workspace, and select the notification channel.

You can configure separate channels for different severity levels (Critical, High, Medium, Low), and notification types are fully customizable.

Not at this point. We have not been through a SOC 2 audit, and saying so is more useful to your review than an answer you would have to verify later.

What does exist is the security whitepaper: where data is stored, who can read it, how customer-managed KMS keys work, and what happens on deletion, documented as implemented rather than as intent.

If your review needs specific evidence, write to compliance@cremit.io and we will tell you plainly whether we can provide it.

Click "Forgot your password?" on the login page and enter your registered email.

A password reset link will be sent to you. The link is valid for 15 minutes.

If you don't receive the email, check your spam folder or contact support@cremit.io.

Cremit detects 1,000+ secret types.

This includes API keys, OAuth tokens, JWTs, SSH private keys, database connection strings, cloud credentials (AWS, GCP, Azure), Stripe/payment keys, and Slack/collaboration tokens.

Findings of supported types are checked against the service that issued them, so your team starts from the set that still authenticates; types without an automatic check are marked for manual review.

If there is a security review, procurement paperwork, SSO and SCIM, or a scope that does not fit the standard plans, email sales@cremit.io.

Team size, the sources you would connect, and any compliance requirements are enough for a first reply you can actually use.

Findings of supported types are checked against the service that issued the credential, so one that was revoked months ago does not arrive looking like a live one. Types without an automatic check are marked for manual review rather than labeled live or dead.

For the cases that keep coming back you can allowlist a pattern or a path, and marking something as a false positive feeds back into detection.

Jira is a scan source: Cremit scans issues and comments for exposed credentials.

Alerts go to Slack, a webhook, Telegram or email. Creating or syncing Jira tickets is not a built-in action today, but the webhook and REST API can feed your own tracker.

Cremit provides a Data Processing Agreement (DPA) and handles the data it processes in line with GDPR and Korea’s PIPA (Personal Information Protection Act).

For DPA or data processing inquiries, contact privacy@cremit.io.

Not today. Cremit scans GitHub, GitLab, Bitbucket, GitHub Packages (including GHCR images), AWS S3, Google Drive, Jira, Confluence, Notion and Slack.

Kubernetes cluster scanning is not available.