map-forge
Provider credentials are encrypted at rest

Optional fallback

Google Maps provider

Configure Google once in the control plane. The credential never enters product apps, Compose files, or runtime responses.

Credential vault

No key stored

disabled

The key is AES-256-GCM encrypted using the installation system password. Updating the password requires an explicit credential rotation.