SOPS (Secrets OPerationS) is open-source software for encrypting configuration files, so that secrets can be stored in Git repositories and decrypted only by authorised users or pipelines. The structure of a file stays visible while its values are encrypted; an entire file can also be encrypted in binary form. Access is managed through identities: a file can be decrypted by a defined set of keys, and several keys can be required together. SOPS is used from the command line and in infrastructure-as-code workflows.
SOPS was first launched as a project at Mozilla in 2015 and is now a sandbox project of the Cloud Native Computing Foundation, which is based in the United States. The software is licensed under the Mozilla Public License 2.0, and the project names the SOPS Authors as copyright holders. Encryption can use offline keys such as age and PGP/GnuPG, or cloud key services. For a European organisation, the data stays wherever the files and keys are kept; the sovereignty question concerns the chosen key service and the foundation that governs the project.