End-to-End Encryption in Vercel Workflow

Vercel Workflow protects the entire path of user data transmission with end-to-end encryption. Input values, step arguments, return values, hook payloads, and stream data are automatically encrypted before being written to the event log, while step functions continue to work exactly as before.

This approach allows sensitive data such as API key, tokens, and user credentials to safely cross boundaries. No plaintext remains in the event log—only ciphertext is stored.

The encryption setup is as follows.

• Each workflow run derives a unique key using HKDF-SHA256.
• Data is encrypted with AES-256-GCM, ensuring confidentiality and integrity.
• Encrypted fields appear with a lock indicator in the dashboard, with their contents hidden until decrypted.

Decryption is possible through two paths.

• In the Web dashboard, pressing the Decrypt button in the run detail panel performs decryption using the browser's Web Crypto API.
• In the CLI, adding the --decrypt flag to the inspect command works.

Decryption permissions follow the same model as permissions for viewing a project's environment variables. Additionally, each decryption request is recorded in the audit log, and custom World implementations can integrate this feature directly by providing getEncryptionKeyForRun().