Retyc for technical teams
Secrets, SQL dumps, certificates, logs: send them end-to-end encrypted, through a link that expires on its own. From the browser, the terminal or your CI.
Use cases
What should never go through Slack
A token pasted in a channel, an SFTP server kept alive just to get a dump out once a quarter: it always ends up lying around somewhere. Retyc Transfer encrypts what you send, and everything disappears when it expires.
Secrets and credentials
With Retyc Transfer, an API key, an OAuth token or a server's root password goes out in a link that can expire after an hour. Just long enough for your colleague to grab it.
Database dumps
A PostgreSQL or MySQL dump of several GB, a NoSQL export: the file is encrypted before it leaves the machine. If it holds personal data, that data never reaches a third party in the clear.
Certificates and private keys
TLS certificates, SSH, GPG or signing keys. If you have doubts about the recipient or the channel, you revoke the link and it stops responding right away.
Logs and config files
A .env, a kubeconfig, logs littered with tokens and internal IPs. People send them without a second thought, yet they open as many doors as a password.
Security
All we see is ciphertext
Encryption happens before sending, on your machine. What reaches us contains no plaintext data, and it disappears on the date you set.
Local encryption before sending
Secrets and dumps are encrypted on your machine before any network call, with keys we don't have. At no point does the server see your data in the clear.
Enough to fill in the security questionnaire
Key rotation on every plan, an exportable audit log, a public technical white paper and subprocessor list. Your CISO gets their answers without setting up a meeting.
Encrypted for the recipient
If your recipient has an account, the file is encrypted with their public key. Only they can open it, even if the link leaks.
Emergency revocation
At the slightest doubt, you cut access and the link stops responding, even if it hasn't expired yet.
Integration
In the browser, the terminal or your code
The same encrypted transfer, whether you go through the web interface, the CLI or the SDK.
Web interface, nothing to install
You drop the file on the page and get a link back. Nothing to install, for you or for the recipient.
Your datarooms as a network drive
The CLI runs a local WebDAV server: you mount your datarooms in Finder, Windows Explorer or any WebDAV client. Encryption happens on your machine, just like in the browser.
Highlights
Less duct tape
A temporary bucket, a VPN set up for the occasion, a file split into chunks: everything people improvise when a large sensitive file has to go out.
Dumps of several tens of GB
A dump of several tens of GB goes out as a single file. No need to split it.
Post-quantum hybrid keys
Keys combine several mechanisms, including one designed to resist known quantum attacks. A file intercepted today should stay unreadable tomorrow.
Or on your own cluster
If your data must not leave your premises, Retyc can be self-hosted: with the Enterprise plan, we provide the Helm chart to deploy the whole platform on your Kubernetes.
Try it from your terminal
The CLI installs with one command, and your first encrypted transfer goes out a few minutes later.
Frequently asked questions
What technical teams ask us most often.
Yes. With the Enterprise plan, we provide a Helm chart that deploys the whole platform on your Kubernetes cluster. Files, accounts and logs then stay within your infrastructure.
The command-line client runs non-interactively. You generate an offline token once with retyc auth login --offline, store it as a CI secret along with your key passphrase, then expose RETYC_TOKEN and RETYC_KEY_PASSPHRASE in the job. On each call the token is exchanged for a short-lived one, without writing anything to the runner's disk.
On the machine running the script, before any network call. Your CI runner therefore needs the private key, which makes it a secret to handle as such. In return, the artifact that reaches us is already encrypted and our infrastructure has never seen the key.
Yes. The same binary exposes a local MCP server, so an agent can create transfers or browse a dataroom in natural language. It runs on your machine with your credentials: nothing is delegated to a third-party service, and the product itself has no AI built in.
Yes, it's published under the MIT license at github.com/retyc/retyc-cli, and the encryption library it uses is open source too. The web application, on the other hand, isn't public; our white paper explains the distinction.
Yes. It's an admin subcommand that writes a tree of folders and JSON files, reports progress on stderr and exits with a non-zero code on failure. The export.json manifest sums up counts and errors, so you can run it from a scheduled job and check the result.