One platform for credentials and access

One vault for every kind of credential.

Store logins, SSH keys, API keys, environment files and secure notes in a vault organized by type — envelope-encrypted, with no plaintext credential material at rest, and built for how engineers actually work.

Every session brokered and audited.

Connect to Linux hosts over SSH and SFTP through an audited access broker. Access is injected just-in-time, decrypted in memory for the authorized session only, and written to the audit trail.

Managed file transfer on the same audited broker.

Move files between SFTP, FTP/FTPS, WebDAV and object storage through the broker that already holds the credentials. Ad-hoc copies, scheduled jobs and watched folders all run server-side, are governed by policy on the way through, and land on the same audit trail as every session.

Share access without losing control.

Shared team vaults with role-based access and just-in-time elevation. Onboard and offboard people in one place, and keep an attributable record of who had access to what, when.

Your vault where you work.

A preview you load yourself: no browser store lists it yet, so Chrome and Edge run it in developer mode and Firefox only as a temporary add-on. It autofills logins and captures new credentials. The extension holds an encrypted copy of your vault on the device, so a fill is a local decrypt that works instantly and offline — sealed under a key your organization can withdraw, with every reveal still recorded.

Assistance that defaults to a self-hosted model.

AI help for the terminal and vault that defaults to a self-hosted model rather than a cloud one, and can be pointed at an endpoint on your own network. Terminal output and credentials do not reach a cloud model unless your organization opts one in — the default and that opt-in are what keep them out.