1claw keeps credentials in HSM vaults with optional MPC key splitting across multiple cloud providers. Agents fetch secrets at runtime, they never appear in context, logs, or memory.