Every secret, every environment, in one place.
Keep your environment variables in one store. Push them to Vercel, Convex, GitHub Actions, Cloudflare, and Google Cloud, and run locally with the orgorg CLI.
Free for teams of 5 or fewer · No credit card
How it works
Three steps. About two minutes.
- 1
Sign in with Google
One click. No form, and no credit card.
- 2
Name your workspace
Usually your company name. Your team can join it later.
- 3
Make your first project
A project holds the environments of one codebase, ready for your keys.
What you get
Everything you need
Environments that inherit
Development, preview, and production extend a base, and override only what differs.
Push to your providers
Every save pushes to Vercel, Convex, GitHub Actions, Cloudflare, and Google Cloud Secret Manager.
The orgorg CLI
`orgorg env run` injects an environment into a local command, with a browser sign-in. No .env file to pass around.
Encrypted per organization
Values are encrypted with a key for each organization, which Cloud KMS wraps.
Every reveal is logged
Each read of a sensitive value writes an event: who, which key, and when.
Rotation with a grace window
Rotate a key from its row. The old value stays available for a grace window, and expiry reminders come a week ahead.
One less subscription
What it replaces
Every OrgOrg app is free for teams of 5 or fewer. Past that, Pro is $10 per member per month for the whole suite, not per app.
Instead of Doppler
One store for secrets, synced to every provider.
Environment Variables, included
Instead of .env files in a chat thread
Hand a new engineer the keys they need.
The CLI, with a browser sign-in and a logged read
FAQ
Questions before you start
Is it really free?
Yes, for teams of 5 or fewer, with no credit card. Past 5 members, Pro is $10 per member per month, and that covers every OrgOrg app.
How are values protected?
Each organization has its own data key, which Cloud KMS wraps. Values are decrypted only on the server, and each reveal of a sensitive value is logged.
Who can read production?
Production is a protected environment. A role alone opens nothing there: only a grant from the project owner or an Owner does.
Which providers can it push to?
Vercel, Convex, GitHub Actions, Cloudflare, and Google Cloud Secret Manager. Each save pushes to the targets that read the key.
Stop pasting secrets. Push them.
Sign in with Google and make your first project in about two minutes.