Secrets are encrypted with AES-256-GCM using keys derived from SSH agent signatures, so they are encrypted at rest and your private key never leaves your machine. Teams can share vaults where each secret is wrapped individually per member, so members can be revoked without re-encrypting everything, and new users join with single-use invite codes.
Read the documentation or browse the source on GitHub.