Two changes to how SIMCOAI stores its own credentials and the secrets it holds on your behalf — a webhook signing secret, a connected AI provider key. Both are now encrypted at rest with ChaCha20-Poly1305, a published, independently reviewed authenticated encryption standard (RFC 8439) also used by Google, Apple and Cloudflare in their own production systems, using full 256-bit keys throughout. Every stored secret carries an authentication tag: if it is altered by even one bit, decryption is refused outright rather than returning a tampered value, and a secret held on your behalf is individually bound to your account, so a copy of one record cannot be read against another.
What changed
This release strengthened protection for stored credentials used by SIMCOAI and secrets held for customer connections. The protection covers stored values as well as a check that encrypted data has not been altered.
Customer-held secrets are also tied to the account they belong to. This is intended to prevent a copied stored value from being treated as a valid secret for a different customer.
Before and after
Before this update: This update replaced the previous credential-storage arrangements with the strengthened encrypted storage described in the announcement.
With this update: Stored secrets receive authenticated encryption, with altered values refused rather than returned as usable credentials. Customer secrets are individually associated with their owning account.
What it means for you
There is no new setup step for this storage change. Continue to keep your own credentials private and manage connected services through the supported account controls.
Encryption at rest is one protection, not a reason to share credentials or grant an integration more access than it needs. The update changes how stored secrets are protected; it does not turn a connection into a public or unrestricted one.
SIMCOAI's own operational credentials — the keys we use to reach our payment, calling, messaging and AI providers — moved out of a plain configuration file and into a dedicated, self-hosted secrets manager running on our own infrastructure, decrypted only in memory at boot and never written to disk as plain text. Nothing about how you use SIMCOAI changes. How we protect your data