Workload Adoption Proof for Zero-Downtime Credential Rotation

Prove Workloads Adopted The New Secret.
Before Revoking The Old One.

Password rotations fail because connection pools hold onto old sessions, and dormant cron jobs break hours later. RotationProof challenges workloads with cryptographic nonces and proves fresh connection recycling before retiring old credentials.

Run Rotation Simulator → 60-Second Hygiene Scanner
100% Offline HMAC Licensing
SOC 2 CC6.1 & ISO 27001 Certified
Zero Secret Material Exfiltration
Connection Pool Drain Guard

Interactive Sandbox

Simulate Dual-Phase Rollout & Workload Adoption Probing

rotationproof-orchestrator // dual-phase
STANDBY
// Target Secret: pg_prod_cluster_creds (PostgreSQL RDS)
// Current Role: db_user_v1 (Active in 3 declared consumers)
// Declared Workloads: web-api (Node), worker-pool (Python), billing-cron (Go)
// Ready. Click "Execute Zero-Downtime Rotation" to begin dual-phase rollout.

Workload Adoption Verification 0 / 3 adopted

No rotation started yet.

Cryptographic Audit Seal

Plan Revision: None
Digest (SHA-256): Unchained
Old Credential Status: Active

Fast Integration

Deploy In Under 60 Seconds

Scan for hardcoded credentials and uncycled connection pools in CI/CD or orchestrate rotations via CLI.

// 1. Audit your repository for exposed credentials & uncycled connection pools:

npx rotationproof scan --dir ./src

// 2. Export a sealed SOC 2 CC6.1 & ISO 27001 auditor pack:

npx rotationproof audit --org "Production Infra" --output ./audit-pack

Public Verification & Trust Badges

Embed Real-Time Credential Rotation Proofs

Prove zero-outage credential rotation and 100% workload adoption directly in your GitHub README.

Live Badge Preview
Markdown Embed
HTML Embed

The False-Positive Paradox

Why Simple Password Rotation Causes Outages

Connecting directly to PostgreSQL RDS with a new password does not prove your application won't crash.

01

Connection Pool Lag

Web servers hold open 50+ persistent database connections for hours. They don't test the new password until a pool connection expires—often during peak traffic.

02

Dormant Scheduled Jobs

Nightly invoice generators and billing crons run once a day. If you revoke the old secret before midnight, you won't discover the broken job until 3:00 AM.

03

Dual-Active Role Architecture

RotationProof provisions two least-privilege database roles (v1 & v2). Old connections drain cleanly under v1 while new workloads attest fresh adoption under v2.

Commercial Licensing & Pricing

Transparent, Enterprise-Ready Plans

Offline cryptographically signed HMAC licensing. Zero database passwords or master credentials leave your VPC.

Community
$0 / mo

Zero-downtime rotation prober for single-cluster database environments.

  • ✓ 1 Secret reference
  • ✓ Up to 3 Workload consumers
  • ✓ Canary connection verification
  • ✓ 60-second hygiene scanner
  • ✓ Dynamic SVG trust badge
  • ✕ Slack/Discord alerts
  • ✕ SOC 2 compliance pack
Team SecOps
$99 / mo

Dual-phase automated rotation and adoption challenges for production engineering.

  • ✓ Up to 5 Secret references
  • ✓ Up to 25 Workload consumers
  • ✓ Automated dual-phase rotation
  • ✓ Slack Block Kit alerts
  • ✓ SOC 2 CC6.1 compliance pack
  • ✓ 99.9% Uptime SLA
Recommended
Enterprise Zero-Outage
$299 / mo

Guaranteed zero-outage rotation orchestration with connection pool drain guards.

  • ✓ Up to 25 Secret references
  • ✓ Up to 100 Workload consumers
  • ✓ Session drain policy enforcement
  • ✓ HashiCorp Vault & AWS sync
  • ✓ SOC 2 & ISO 27001 auditor packs
  • ✓ Discord & Slack broadcasters
Global Fleet
$699 / mo

High-throughput multi-cluster database fleets across hybrid cloud environments.

  • ✓ Unlimited secret references
  • ✓ Unlimited consumers
  • ✓ Multi-cluster database fleets
  • ✓ Custom IAM & Vault adapters
  • ✓ Dedicated 1h Critical SLA
  • ✓ Signed compliance certificates

Frequently Asked Questions

How does RotationProof verify connection pool recycling?

RotationProof compares the connection establishment timestamp against the rollout start time. If a connection was established before the new secret version was deployed, RotationProof rejects the attestation as a stale pooled session.

Does RotationProof store our database passwords?

No. Under Spekra's Zero-Trust architecture, RotationProof operates solely via opaque secret references. The customer runner connects directly to your local secret manager and database. Raw passwords never touch our control plane.

What if a workload fails to adopt the new credential?

The Revocation Guard immediately blocks retirement of the old credential. The system stays in the dual-active state where both credentials remain valid, alerting engineers in Slack. Zero production downtime occurs.

What session policies are supported during retirement?

RotationProof supports three session policies: wait_for_drain (waits for active transactions to finish naturally), drain_and_terminate (terminates long-lived idle sessions after a configurable grace period), and reject_new_only (disables new logins while existing sessions complete).