The Vault keeps the passwords, tokens, keys and certificates that belong to your own equipment and systems on the records that need them, along with copies of your network equipment's configs. Everything in it is encrypted, and only roles you choose can show it.

What belongs in the Vault

The Vault is not a password manager. It holds the one-off secrets that belong to your company's own equipment and systems:

• a laptop's BIOS password or a server's local administrator password
• a router's enable secret
• an SSH key pair, or a device's certificate and private key
• the token a server uses to reach your code
• a copy of a switch or firewall's running config

People's own logins to websites and online services stay in a password manager such as 1Password, Bitwarden or Keeper. The Vault has no browser extension, no autofill and no personal vaults, and it does not share anything outside your company.

Each secret sits on the record it belongs to: a piece of equipment, a software product, a service, a circuit or a client. One secret can sit on many records, such as one BIOS password shared by a batch of laptops, so changing it once changes it everywhere.

Pages in this section

• Turning on the Vault: the disclaimer, choosing which key encrypts it, how many config copies to keep, and turning it off.
• Secrets: adding, showing, copying, editing and deleting secrets, earlier values, and changing what someone saw after they leave.
• Config backups: saving a copy of a network device's config before and after a change, and comparing two.
• Trusted browsers: asking for access and approving a colleague's browser when your company holds its own key.
• Exporting the Vault: an encrypted ZIP of every secret, for Admins.