Encrypted at rest and delivered only to an authorized binding. The secret is write-only and never shown again.
A project owns a workspace and the tasks that run in it. With the account default, the server picks where it runs.