Security

Overview

Servy securely encrypts stored passwords using AES encryption.

The AES encryption key and initialization vector (IV) are protected using Windows DPAPI with the LocalMachine scope. This ensures the key and IV can only be decrypted and used on the same machine where they were created.

File Locations

Servy stores the AES key and IV in the following files:

# AES Key
C:\ProgramData\Servy\security\aes_key.dat

# AES IV
C:\ProgramData\Servy\security\aes_iv.dat

Changing Keys

You can replace the AES key and IV by modifying the files above.

Changing either file will make all previously encrypted passwords impossible to decrypt.

Only replace these files if:

• You are setting up a new Servy installation
• You have a migration plan to re-enter or re-encrypt credentials

Best Practices

• Backup first: Keep a secure backup of the existing key and IV before making changes
• Restart required: Restart the Servy app after modifying these files
• Restrict access: Limit access to the C:\ProgramData\Servy\security folder so only trusted administrators can read/write these files
• Do not share across machines: Because DPAPI LocalMachine scope is used, copying the files to another machine will not work

Troubleshooting

• Encryption errors: If Servy cannot decrypt stored passwords, verify that the key and IV files exist and are intact
• Corrupted files: If either file is corrupted or partially overwritten, previously encrypted passwords will be unrecoverable
• Permissions issues: Ensure Servy app have sufficient access to read the key and IV files in C:\ProgramData\Servy\security
• User account mismatch: Although LocalMachine scope is used, very restrictive security settings may prevent some service accounts from accessing the files