Sanctum Vault / Credential management
Organise credentials and secrets used by infrastructure, applications and service accounts.
Internal tool · adaptable for client work
How it fits your work
All secrets are encrypted at rest using AES-256-GCM with application-layer key derivation. Neither the storage layer nor the filesystem can read plaintext without authorisation.
Provision, rotate, and revoke API keys and service account credentials with a single interface. Auto-generate cryptographically random tokens with scoped permissions.
Fine-grained role-based access control governs who can read, write, rotate, or delete each secret. Integrates with existing OIDC providers for seamless authentication.
The entire vault runs on your own metal — no external secret management APIs, no cloud KMS, no SaaS backends. If your network is up, your vault is accessible.
Start with a real use case
Tell us about the work, the people involved and the result you need. We’ll agree the capabilities and implementation scope together.
Already have access? Sign in to Sanctum Vault ↗