One platform for secrets and access

One vault for every kind of secret.

Store logins, SSH keys, API keys, environment files and secure notes in a vault organised by type — envelope-encrypted, never plaintext at rest, and built for how engineers actually work.

Every session brokered and audited.

Connect to any host — Linux over SSH or Windows over RDP — through an audited access broker. Access is injected just-in-time, decrypted in memory for the authorized session only, and written to a complete audit trail.

Managed file transfer on the same audited broker.

Move files between SFTP, FTP/FTPS, WebDAV and object storage through the broker that already holds the credentials. Ad-hoc copies, scheduled jobs and watched folders all run server-side, are governed by policy on the way through, and land on the same audit trail as every session.

Share access without losing control.

Shared team vaults with role-based access and just-in-time elevation. Onboard and offboard people in one place, and keep an attributable record of who had access to what, when.

Your vault where you work.

Autofill logins and capture new credentials in Chrome and Firefox. The extension holds an encrypted copy of your vault on the device, so a fill is a local decrypt that works instantly and offline — sealed under a key your organization can withdraw, with every reveal still recorded.

Assistance that defaults to a self-hosted model.

AI help for the terminal and vault that defaults to a self-hosted model rather than a cloud one, and can be pointed at an endpoint on your own network. Terminal output and secrets do not reach a cloud model unless your organisation opts one in — the default and that opt-in are what keep them out.