Additional Terms: Secrets (GCP — Secret Manager)

Effective Date: April 16, 2026
Cloud Provider: Google Cloud Platform
GCP Service: Secret Manager
Document ID: QUOME-LEGAL-SECRETS-GCP-001

These Additional Terms govern your use of the Quome Secrets service ("Secrets") when backed by Google Cloud Platform. These terms supplement the Terms of Service.

1. Service Description

Secrets enables you to store, manage, and inject sensitive values (API keys, passwords, tokens, connection strings) using Google Secret Manager within your GCP project. Quome handles secret creation, versioning, rotation, and injection into applications, workflows, and sandboxes on your behalf.

2. Infrastructure Ownership

All secret data resides in Secret Manager within your GCP project. Quome's control plane stores only metadata: secret name, description, type, vendor classification, and rotation status. Quome's control plane never stores secret values.

3. Customer Responsibilities

(a) You are responsible for the accuracy and security of all secret values you store;

(b) You must not store secrets that violate Applicable Law or third-party agreements;

(c) You are responsible for rotating secrets in accordance with your security policies;

(d) You must manage access to secrets through Quome's service account permission system — granting only the minimum necessary access to each workflow, application, or agent.

4. Secret Access and Auditing

(a) Every access to a secret value is audit-logged with the requesting identity, timestamp, and access context;

(b) Secret values are fetched at runtime through Quome's delegate service account and injected into the requesting service (application env var, workflow sandbox env var, etc.);

(c) Secret values are never cached in Quome's control plane — each access results in a fresh fetch from Secret Manager;

(d) Quome supports auto-detection of secret vendors (Slack, GitHub, OpenAI, Anthropic, etc.) for rotation guidance.

5. Termination Effects

Upon termination, all secrets remain in Secret Manager within your GCP project. You retain full access via the GCP Console.

Cloud Provider Reference

AWS (Secrets Manager) and Azure (Key Vault) Additional Terms will be published when those providers reach general availability.