Policy
Do not put registrar passwords, hosting passwords, API secrets, private keys, card numbers, or client passwords into Duvento — including notes. The Terms call this “no secret storage”. Notes accept any text; there is no scanner that blocks secrets. If a secret was pasted by mistake, edit it out and rotate the credential.
What Duvento stores on purpose
Telegram bot tokens, Slack webhook URLs, and similar integration credentials belong in the dedicated Cloud connection fields (encrypted), not in notes. The webhook signing secret is an exception: it is stored in plaintext. Duvento tracks dates and contacts; it is not a vault.
What to use instead
Keep credentials in a password manager. In Duvento store the expiry date, who pays, and a notice email.