An Admin turns the Vault on once for the company and chooses which key encrypts it. Until then, the Vault page and the Secrets and Config backups panels do not appear.

Overview

Vault settings is its own page under Administration. It explains what the Vault is for and how it is protected, then asks two things: that you understand what it is for, and which key encrypts it.

What it is for

The page opens with the Vault's disclaimer: the Vault is not a password manager. It holds the one-off secrets that belong to your own equipment and systems, such as a BIOS or local administrator password, an SSH key, a device's certificate, or the token a server uses to reach your code. Logins to websites and online services belong in a password manager.

How it is protected

• Each secret is encrypted with AES-256 under your company's own key.
• Only roles with See secrets and config backups can show one, after a recent password or passkey check. Every time a secret is shown or copied is recorded with who and when, and Admins are emailed when someone shows an unusual number.
• Secrets never appear in the data export, emails or logs, and TekStacks staff cannot see them.

The two keys

Choice	What it means
Use TekStacks' key (the default)	Your team has access at once, based on their permissions. Your company's key is stored only locked by a key kept apart from the database and its backups, so a copy of the database alone opens nothing. TekStacks' servers can decrypt your secrets in order to show them to your team, so this is not zero knowledge encryption.
Use your own key	Only browsers you trust can show secrets, and TekStacks cannot read them. Each person's browser is approved once by someone already trusted, or with a recovery key you save. If you lose every trusted browser and the recovery key, nobody can open the secrets, TekStacks included. See Trusted browsers.

Choose TekStacks' key unless you need TekStacks to be unable to read your secrets and are ready to look after a recovery key and approve each new browser.

The choice locks

You can change the key until the first secret is saved. After that it is fixed, and the page says: "The Vault holds secrets, so its key is fixed." To change it later, export the Vault, turn it off, turn it on with the other key, and add the secrets again.

Requirements

• Role: Admin (Company settings, custom domain and storage, which only the Admin role has).

Turn on the Vault with TekStacks' key

1. In the sidebar, open Administration, then Vault settings.
2. Read What it is for and How it is protected.
3. Under Which key encrypts it, leave Use TekStacks' key selected.
4. Tick I understand the Vault is for secrets that belong to our equipment and systems, not a password manager.
5. Click Turn on the Vault.

The page now reads "On since" with the date, and links to Open the Vault.

Turn on the Vault with your own key

Do this in the browser you will use for the Vault: it becomes the first trusted browser.

1. In the sidebar, open Administration, then Vault settings.
2. Under Which key encrypts it, select Use your own key.
3. Tick I understand the Vault is for secrets that belong to our equipment and systems, not a password manager.
4. Click Turn on with our own key. Your browser makes the company's key and a recovery key.
5. Under Your recovery key, shown only now, click Copy and save the key in your password manager. TekStacks cannot recover it.
6. Tick I saved the recovery key, then click Done.

The recovery key lets a new browser in when nobody trusted is around, and it is the only way back in if every trusted browser is lost.

Set how many config copies to keep

Once the Vault is on, the same page sets how many config backups each network device keeps.

1. Open Administration, then Vault settings.
2. In Config copies kept per device, enter a number from 1 to 100. The default is 10.
3. Click Save.

Lowering the number does not delete anything at once. Older copies beyond it are deleted the next time a copy is saved for that device.

Turn off the Vault

Turning the Vault off deletes every secret and its earlier values, every config copy and every trusted browser, on every client. It cannot be undone, so export first if you need them.

1. Open Administration, then Vault settings.
2. Click Turn off and delete every secret.
3. Under Type DELETE to confirm, type DELETE in capitals.
4. If you are asked, enter Your password.
5. Click Delete every secret.

Notes

Note: Turning the Vault on records which Admin did it and when.

Note: If your company manages clients, one Vault covers every client, and each client's secrets stay with that client. Turning it off deletes the secrets of every client.

Troubleshooting

"Tick that you understand what the Vault is for." Tick the I understand box before turning it on.

"Your own key is made in your browser: use Turn on with our own key." With Use your own key. selected, use the Turn on with our own key button instead of Turn on the Vault.

"TekStacks' key is not set up on this server yet, so this choice cannot be turned on." This is on TekStacks' side. Contact TekStacks support.

The key choices are grayed out. The Vault already holds secrets, so its key is fixed. See The choice locks.

There is no Vault settings link under Administration. Only Admins see it, and only when the Vault is available on your account.

FAQ

Can TekStacks staff read our secrets? No. TekStacks staff cannot see secrets with either key. With TekStacks' key, TekStacks' servers decrypt a secret to show it to someone on your team who is allowed to see it. With your own key, they cannot decrypt it at all.

Can we switch from one key to the other later? Only before the first secret is saved. After that: export, turn the Vault off, turn it on with the other key, and add the secrets again.