Deploying to someone else's cloud means you need permission to act there. The usual shortcut is a service-account key: a long-lived file the customer downloads and uploads to the tool. It works, and it is also one of the riskiest things a platform can hold. A key does not expire on its own, it can be copied, and whoever has it can act as the account until someone notices and deletes it.

Early versions of LineXa Studio worked this way. When we reviewed the platform before launch, we made a simple decision: LineXa should not store customer keys at all. Encrypting them would not have been enough, because the key to decrypt them would live on the same server.

How access works instead

LineXa now uses service-account impersonation. In short:

  1. For each of your environments, LineXa has a dedicated service account.
  2. You grant that account a LineXa role in your own Google Cloud project. The role's permissions are published as a plain YAML file, so your team can read exactly what it allows before installing it.
  3. When LineXa needs to deploy, it asks Google for a short-lived token for that account. The token expires on its own; nothing long-lived is written to disk.

LineXa's own server has a single credential of its own, kept readable only by the system, never logged, and rotated on a schedule. Customer keys from the earlier design were deleted from our servers as part of the change.

What this changes for you

  • There is nothing to leak. A copy of our database or a backup does not contain a key to your project.
  • You stay in control. Remove the role from your project and LineXa's access stops immediately, without asking us.
  • It is reviewable. The permissions LineXa needs are visible and limited to what deployments require.

The trade-off

Keyless access takes one more setup step: installing the role in your project, done once from Cloud Shell. We think that is the right price for not having a permanent key to your infrastructure sitting on anyone's server, including ours.

You can read more about how we protect your workspace on our Trust center.