Retyc for technical teams
Transfer secrets, SQL dumps, certificates and sensitive logs safely. End-to-end encryption and automatic expiry for your DevOps operations.
Use cases
Use cases for devs and ops
Stop pasting secrets into Slack, and stop maintaining an SFTP server just to get a dump out. Retyc Transfer encrypts your most sensitive sends, Retyc Box collects logs and backups from your servers, with scheduled destruction at expiry.
Transferring secrets and credentials
With Retyc Transfer: API keys, OAuth tokens, root passwords, SSH access... Very short expiry available, from 1 h to 24 h.
Database exports
SQL dumps, PostgreSQL/MySQL backups, NoSQL exports. Large files (several GB) encrypted automatically. GDPR compliance for personal data.
Certificates and private keys
SSL/TLS certificates, SSH keys, GPG keys, signing keys. Encrypted transfer with instant revocation on suspected compromise.
Logs and configuration files
Application logs carrying tokens, stack traces with internal IPs, .env files, kubeconfigs. Automatic encryption of the sensitive data they embed.
Security
Advanced technical security
Encryption happens before sending, on your machine. What reaches us contains no data in the clear, and disappears on the date you set.
Local encryption before sending
Your secrets and dumps are encrypted on your device before any network transfer. We never see your data in the clear, not even encrypted server-side with our own keys.
Enough to fill in the security questionnaire
Encryption key rotation on every plan, an exportable audit log, a public technical white paper and a published subprocessor list. Your CISO will find their answers without asking you for a meeting.
Automatic encryption to a key
If your recipient has an account, their public key is used automatically to encrypt the data. They alone can decrypt it, even if the link were to leak.
Emergency revocation
A kill switch. At the slightest suspicion of compromise, you cut access and the link stops responding.
Integration
Integration and automation
Web interface, CLI or SDK: the same encrypted transfer, from the tool you already use.
Web interface, nothing to install
Upload from any browser. Drag and drop your dump or secret, generate an encrypted link in one click. No tool to install.
Automated secure intake
With Retyc Box, create intake links to automate the collection of logs, dumps or backups from your production servers. Sent straight from scripts.
Highlights
Why technical teams pick Retyc
What the teams using it mention first when asked why they stopped rigging up something else.
Dumps of tens of GB
Transfer SQL dumps of several tens of GB without splitting them, and without standing up a temporary S3 bucket for the occasion.
Hybrid post-quantum keys
The keys combine several mechanisms, one of them designed to resist known quantum attacks. A secret intercepted today is meant to stay one.
Nothing to provision
No S3 bucket to create, no VPN to stand up, no file server to maintain. Just a link.
Try it from your terminal
The CLI installs in one command and a first encrypted transfer takes a few minutes. If you would rather see the whole picture first, ask us for a demo.
Frequently asked questions
Retyc on the DevOps side, in a few answers.
The command-line client runs non-interactively. You generate an offline token once with retyc auth login --offline, store it as a CI secret alongside your key passphrase, then expose RETYC_TOKEN and RETYC_KEY_PASSPHRASE in the job. On each call the token is exchanged for a short-lived one, without writing anything to the runner's disk.
On the machine running the script, before any network call. Your CI runner therefore needs the private key, which makes it a secret to be treated as such. In exchange, the artefact reaching us is already encrypted and our infrastructure has never seen the key.
Yes. The same binary exposes a local MCP server, letting an agent create transfers or browse a dataroom in plain language. It runs on your own machine with your credentials: nothing is handed to a third-party service, and the product itself carries no AI.
Yes, it is published under the MIT licence at github.com/retyc/retyc-cli, and the encryption library it uses is open source too. The web application, on the other hand, is not public, and our white paper makes that distinction.
Yes, it is an admin subcommand that writes a tree of folders alongside JSON files, with a progress bar on stderr and a non-zero exit code if anything failed. The export.json manifest sums up the counts, the errors and the datarooms skipped, which makes it a good candidate for a scheduled job. The scope is described in detail on the enterprise page.