> `Warning:` This Epic's description is a mirror of the [roadmap documentation](https://selorahomes.com/docs/roadmap/secure-credential-management-for-installation/). Please propose all content changes via a Merge Request in the repository. ## Overview During home installations, certain devices and integrations require credentials (usernames, passwords, API keys) that homeowners consider sensitive. Currently installers have full visibility into these credentials — they can see, copy, and retain them indefinitely. This creates a privacy and security risk. This feature introduces a secure credential vault that acts as a zero-knowledge proxy: homeowners share credentials with Selora Connect, not with the installer. The installer can request credential usage for specific integration/device configuration tasks without ever seeing the actual credentials. Credentials are encrypted with AWS KMS, stored securely, and deleted after the installation is completed and approved by the homeowner. ## Workflow 1. **Credential Submission** — During installation, the homeowner (or installer on behalf of the homeowner) submits credentials for a specific device/integration through Selora Connect. 2. **KMS Encryption** — Credentials are immediately encrypted using AWS KMS keys tied to the homeowner's account. The installer never sees plaintext credentials. 3. **Installer Requests Credential Usage** — When the installer needs to configure an integration or device, they request credential usage through the installer dashboard. The request includes: what integration/device, what credentials, and why. 4. **Homeowner Approval** — Homeowner receives a notification (email + dashboard) showing which credentials are being requested, for what device/integration, and by which installer. They approve or deny each request. 5. **Credential Provisioning** — Upon approval, the encrypted credentials are made available to the installer's session for the requested purpose only. The installer's session decrypts and uses them inline — the credentials are never exposed as plaintext to the installer. The session is logged. 6. **Credential Deletion** — After the installation is approved by the homeowner, the credentials are permanently deleted from Selora Connect storage. The installer's session is terminated. ## Device Provisioning When a new device is being installed and the homeowner needs an account (e.g., a camera service, security system, or third-party integration): 1. **Automated Account Creation** — Selora Connect creates the device account on behalf of the homeowner using provisioning APIs. 2. **Credential Release** — After installation is approved, the generated credentials are delivered directly to the homeowner's Selora Connect dashboard. The installer never sees them. 3. **Homeowner Verification** — Homeowner receives a notification with a summary of the newly provisioned account (device name, service, creation date). They can activate or reject the account. ## Security Model - **KMS-Encrypted Storage**: All credentials are encrypted at rest using AWS KMS customer-managed keys. Each homeowner has their own KMS key alias. Credentials are never stored in plaintext in any database, log, or backup. - **Zero-Knowledge for Installers**: The installer UI only shows credential metadata (what service, what device, when it was submitted) — never the actual username or password. - **Session-Only Decryption**: When the installer requests credentials for configuration, decryption happens in-memory within the installer's session and is logged. The credentials are never written to disk. - **Automatic Expiration**: Credentials expire after the installation is approved or after a configurable TTL (default: 48 hours after installation approval). Expired credentials are permanently deleted. - **Audit Trail**: Every credential submission, access request, approval, and deletion is logged with timestamps, installer identity, and homeowner actions. ## Customer Value - **Homeowner privacy**: Credentials are shared only with Selora's secure vault, not with the installer who may leave or have access to other customers. - **Trust through transparency**: Homeowners always know which credentials were used, for what devices, and by which installers. - **Reduced liability**: No credentials in installer systems means no credential leakage if an installer's systems are compromised. - **Compliance**: Meets privacy regulations by design — credentials are deleted after use, with no retention risk. ## Scope (first iteration) - KMS-encrypted credential storage and management. - Installer credential usage request workflow (submit request → homeowner approval → use → delete). - Device account provisioning API (auto-create accounts, deliver credentials to homeowner). - Email notifications for credential submission, requests, approvals, and deletions. - Dashboard UI for homeowners: view submitted credentials, approve/deny requests, verify provisioned accounts. - Dashboard UI for installers: request credential usage, see metadata only, no plaintext access. ## Target Customers - **Homeowners**: Protect their account credentials during third-party installation work. - **Installers**: Configure devices without handling sensitive credentials — reducing liability and complexity. - **Security teams**: Meet compliance requirements for credential handling and data minimization. ## Technical Considerations - **KMS Integration**: AWS KMS with customer-managed keys, key rotation policies, and cross-account access controls. - **Secret Management**: Secrets Manager or equivalent for runtime credential retrieval during installer sessions. - **Audit Logging**: All credential access must be logged to CloudWatch/CloudTrail for traceability. - **Installer Session Isolation**: Installer sessions must be sandboxed to prevent credential extraction (no copy-paste, no screenshots, no export). ## Related - Support Access Requests Validation (Epic #60): [Roadmap](https://selorahomes.com/docs/roadmap/support-access-requests-validation/) — the approval workflow that also gates credential requests.