# Secret rotation

URL: /systems/trust-and-governance/controls/secret-rotation · Id: `control:secret-rotation`

> Every secret rotates within its maximum age, and a leaked secret is revoked within one hour of detection.

Every secret rotates within its maximum age, and a leaked secret is revoked within one hour of detection.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| [ISO27001 A.5.17](/systems/trust-and-governance/criteria/iso27001/a-5-17) | The allocation and management of authentication information is controlled. |

## Implemented by
- [Security](/workflows/processes/security)
- [Secrets](/code/platform/secrets)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every secret held in any namespace, on each day of the report period. |
| Assert | No secret exceeds its maximum age, and every detected leak has a revocation Event within one hour. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A payment key for a print-on-demand shop appears in a public paste. Leaked-key scanning revokes it 12 minutes after detection and issues a new one.