Canvas requires secrets such as credentials to your warehouse and dbt project. These secrets are doubly encrypted at rest using database encryption and an additional layer of encryption via Amazon KMS. They are only readable by a service that's inaccessible from public internet and cannot be retrieved once saved.