Solutions Vault
Stop keeping passwords in code. Let programs ask when they need them.
A database password in a .env file or an API key in Git leaks easily, and changing it means editing many places. Vault keeps these in one place: only services you allow can read them, and you can see who read what and when.
Secrets in one place
- Versioned: change a value and the old one stays, so you can go back by disabling the new version
- Ready to use as variables: set a Container or Function variable to
vault://app/db-passwordand your code stays the same. The value is opened when it starts - Expiry dates, version by version
- Recoverable after deleting, for the 7 to 90 days you choose
Encryption keys that never leave
- Encrypt, decrypt, sign and verify through an API, with AES-256-GCM, RSA and ECDSA
- Keys rotate on the schedule you set, and existing data still decrypts
- For large data, use a data key to encrypt in your own program, and store the wrapped key beside the data
Know who reached what
- Give a service account access vault by vault. Removing it works at once
- Viewers and Operators in the Project see names, not values
- The activity shows who read or used what and from which IP, including refused calls
- Use the SDKs for Node.js, Python and Go, or the REST API from any language
Frequently asked questions
How is Vault different from a .env file?
A .env file travels with the machine or Git, and nothing says who read it. Vault encrypts values under a key per vault, gives access service by service, changes a value in one place and records reads.
Do I have to change my code?
Not to use a secret as a Container or Function variable: your code reads the variable as before. To encrypt, or to read the latest value while running, use an SDK or the REST API.
How is Vault billed?
A vault itself is free. You pay for the secrets and keys you keep and for calls from programs. Reading a value as a variable when a service starts, the Console and the th CLI are free. See the pricing page for rates.
Are keys kept in an HSM?
No. Keys are encrypted in software and stored in the system's database. There is no HSM option yet, and you cannot bring your own key yet.
Is it ready to use?
Vault is in Preview and works today.
Get started today, free
Sign up with email, no credit card needed. Websites are free with no expiry; other services are paid as used from the project’s wallet.