Glossary

Credential broker

The Credential Broker is the Substrate's secret keeper: it stores credentials under per-organisation encryption and resolves them on demand for authorised invocations. Credentials never leave the broker in plaintext and are never cached outside it. In cloud mode, KMS separation ensures Oraclous-the-company cannot unilaterally decrypt them. It holds BYOM provider credentials and OAuth tokens.