Secrets · Actionsets · Key Management
Security,
Simplified.
A modern secrets management platform with envelope encryption, role-based access, and extensible actionsets — so you can focus on your product, not your infrastructure.
Self-hosted · Bring your own KMS root key
Envelope encryption on every secret
Plaintext secret names at rest
Built-in actionsets, from raw to redis
Of decrypts recorded in the audit trail
A platform, not a vault
Identity, key management, and secret storage are separate services with their own boundaries — composed into one product.
Secrets & Stashes
Envelope encryption with per-secret DEKs wrapped by a versioned KMS. Blind-index name lookup keeps secrets out of URLs and logs. Role-based stash access with org/team scoping.
Auth & Identity
Credentials, Google OAuth, and magic links. Personal orgs per user with team and role membership. Programmatic access for bots and service accounts.
Key Management
Versioned KEKs persisted wrapped under a non-exportable root key. Admin-gated rotation with full audit trail. DEKs per secret, rotated independently.
Actionsets
Values shaped at read time
Each secret's rules pick an action per caller. The action mints, fetches, or derives the value — and cleans it up on revoke.
A static value, returned as-is on execute.
Short-lived Postgres roles with scoped table grants.
Per-requester MySQL users, revoked on demand.
SQL Server logins plus per-database users.
Templated keys, list append, and a caching wrapper.
How it works
Three steps from zero to encrypted.
Create a stash
Organize secrets by team or project. Set read and write roles to control who sees what.
Store secrets
Each secret gets its own encryption key, wrapped by the KMS. Names are blind-indexed — never stored in plaintext.
Access securely
Actionsets shape values at read time. Ephemeral credentials expire and clean up automatically.