Security

Overview

Servy securely encrypts stored passwords, environment variables and process parameters using AES encryption.

The AES encryption key and initialization vector (IV) are protected using Windows DPAPI with the LocalMachine scope. This ensures the key and IV can only be decrypted and used on the same machine where they were created.

Security Model & Limitations

Servy manages service definitions and related state in a shared configuration directory under %ProgramData%\Servy. All accounts running Servy services must have write access to %ProgramData%\Servy.

Servy does not implement isolation between different Windows accounts or services that share this configuration directory. In practice this means:

• Any account with write access to %ProgramData%\Servy may be able to influence the configuration or behavior of other Servy-managed services on the same machine.
• You should treat all accounts used to run Servy services that share this directory as being in the same trust boundary.
• Servy is not intended for multi-tenant or hostile/untrusted workloads, or for scenarios where services running under different accounts must be strictly isolated from each other. If you require strict isolation between services, consider using separate machines/VMs or alternative mechanisms that enforce per-service isolation between Windows accounts.

File Locations

Servy stores the AES key and IV in the following files:

# AES Key
%ProgramData%\Servy\security\aes_key.dat

# AES IV
%ProgramData%\Servy\security\aes_iv.dat

Changing Keys

You can replace the AES key and IV by modifying the files above.

Changing either file will make all previously encrypted passwords impossible to decrypt.

Only replace these files if:

• You are setting up a new Servy installation
• You have a migration plan to re-enter or re-encrypt credentials

Best Practices

• Backup first: Keep a secure backup of the existing key and IV before making changes
• Restart required: Restart the Servy app after modifying these files
• Restrict access: Limit access to the %ProgramData%\Servy\security folder so only trusted administrators can read/write these files
• Do not share across machines: Because DPAPI LocalMachine scope is used, copying the files to another machine will not work

Troubleshooting

• Encryption errors: If Servy cannot decrypt stored passwords, verify that the key and IV files exist and are intact
• Corrupted files: If either file is corrupted or partially overwritten, previously encrypted passwords will be unrecoverable
• Permissions issues: Ensure Servy app have sufficient access to read the key and IV files in C:\ProgramData\Servy\security
• User account mismatch: Although LocalMachine scope is used, very restrictive security settings may prevent some service accounts from accessing the files