---
title: Secret Manager - Concepts
description: Discover essential concepts of Scaleway Secret Manager, including secret versioning, ephemeral policies, and path management.
tags: secret-manager secret version
dates:
validation: 2025-09-03
---
import image from './assets/scaleway-secret-manager-schema.webp'
## Disabling a version
Disabling a version is the action of temporarily revoking access to the data contained within a specific version. This prevents any users and applications from accessing your data.
Refer to the [How to manage a version](/secret-manager/how-to/manage-version/) documentation page for more information.
## Enabling a version
Enabling a version is the action of making the data contained within the version accessible for retrieval by authorized users and applications. This allows you to manage access to your data and control which versions are accessible, at any time.
Refer to the [How to manage a version](/secret-manager/how-to/manage-version/) documentation page for more information.
## Ephemerality properties
When applying an [ephemeral policy](#ephemeral-policy) to your secret, you must define at least one ephemerality property:
- **Single access**: allows you to set your secret versions to **expire after one single access**.
- **Time to Live**: allows you to set a time frame of up to one year, during which your secret versions are valid and accessible.
## Ephemeral policy
An ephemeral policy is a statement that defines the lifetime of a secret and its versions, using either the **Single access** or the **Time to Live** [ephemerality properties](#ephemerality-properties).
The ephemeral policy also allows you to decide whether to [**disable**](#disabling-a-version) or **delete** your secret's versions, once the versions have expired.
- The ephemeral policy can only be applied to a secret at creation, and **cannot be removed** once applied.
- If applied to a secret, all its versions inherit their settings from the policy.
## Ephemeral secret
An ephemeral secret is a secret that has a limited lifetime, enforced by an [ephemeral policy](#ephemeral-policy).
All the secret's versions automatically inherit their settings from those of the current ephemeral policy.
[Enabling](#enabling-a-version) a version that was previously [disabled](#disabling-a-version) amounts to recreating the version. If you have updated the secret's ephemeral policy while the version was disabled, enabling it again makes it inherit its settings from those of the current ephemeral policy.
## Path
A path refers to the directory structure to access your secrets and their versions. Each path is prefixed with a slash.
For example, if you create a secret `my-secret` within the path `/my-path`, your secret can be accessed at the `/my-path/my-secret` path.
- A path can only contain names of 1 to 255 alphanumeric characters, dots, underscores, and dashes.
- If you leave the path name field empty when creating your secrets, the default path will be `/`. Your secrets and versions will be stored under the `/` path.
## PEM
A PEM or **Privacy Enhanced Mail** file is a security certificate file used to establish a secure communication channel between a web server and a browser. It is encoded in Base64 and may contain a private key, a server certificate and/or a combination of other certificates.
## Region
A region is the geographical area in which your secrets, and versions are stored and run. They are duplicated on all [Availability Zones](/instances/concepts/#availability-zone) of the selected region (Paris, Amsterdam, or Warsaw).
Secret Manager allows you to select your resources by region. This allows you to better sort through your resources, if you have created them in different regions but with the same name, for example.
## Secret
Secrets are logical containers made up of zero or more immutable versions, that hold sensitive data. Upon creation, you can choose between 6 [secret types](#secret-types). The default secret type is the `opaque` one.
The secret versions must be of the same type as the secret.
## Secret Manager
Secret Manager is a solution that provides a centralized location where your secrets can be stored and accessed. Its primary purpose is to securely store secrets, thus eliminating the need for developers to hard code sensitive information in applications or configuration files.
With Secret Manager, you can also share sensitive data such as passwords, API keys, and certificates.
Scaleway's Secret Manager can be managed using [APIs](https://www.scaleway.com/en/developers/api/secret-manager/) and the Scaleway [CLI](https://www.scaleway.com/en/cli/), which allow authorized applications or services to retrieve secrets securely. This enables you to automate a deployment by fetching your passwords stored on Secret Manager through the API, and storing them in your environment variables, which will then be used by your application.
## Secret protection
Secret protection is a feature that prevents the deletion of your secrets. Users holding the `SecretManagerFullAccess`, `SecretManagerSecretWrite`, and `AllProductsFullAccess` [permission sets](/iam/reference-content/permission-sets/) can enable it, ensuring that although your secrets can be accessed and modified, they remain **impossible to delete**.
This ensures the protection of critical information against accidental deletion while maintaining secret management flexibility.
Although a protected secret cannot be deleted, its versions can.
## Secret types
Secret types refer to the different kinds of sensitive data you can store with Secret Manager. Using secret types guarantees that all mandatory fields are present, facilitates the application of specific policies, and enhances integration with other products. Refer to the [Understanding secret types](/secret-manager/reference-content/secret-types-json-format/) documentation page for more information on available secret types
Upon secret creation, you must choose a secret type that will also be applied to the secret version. All the secret's subsequent versions must be of the same type.
## Scheduled deletion
Scheduled deletion lets you mark a secret and its versions for deletion ahead of time. Instead of immediate deletion, the secret enters a 7-day pending deletion period, during which you can still [recover it](/secret-manager/how-to/recover-secrets/).
During this time, you can read secret versions but cannot edit, access, or delete them. After the retention period, the secret and all its versions are permanently deleted. You can also schedule a secret version for deletion without impacting the secret associated with the version.
Recovering deleted secrets is billed €0.01 per version associated with the secret.
## Tag
Tags allow you to organize your secrets. This gives you the possibility of sorting and filtering your secrets in any organizational pattern of your choice, which in turn helps you arrange, control, and monitor your secrets.
## Version
Versions store the data contained in your secret (API keys, passwords, or certificates). Versions can be [**enabled**](#enabling-a-version) or [**disabled**](#disabling-a-version) depending on your usage. Versions must be of the same type as the secret they belong to.
Refer to the [How to add a version](/secret-manager/how-to/create-version/) documentation page for more information.