The same protection for everyone. Choose who shares.
Every plan seals each item on its own and waits for your phone before anything opens. Personal is your own vault. Organization adds vaults your team shares, with access you control.
Personal
For you, on every device you own.
- Logins, servers, keys, API secrets, signing keys, cards, identities and notes
- Mac, Chrome and Android; up to 10 browsers and computers
- Unlocks and cards approved on your phone, with number matching
- AI agents over MCP: [LIMIT] connected agents
- Import from 12 password managers or any CSV
Organization
For teamsFor teams that share servers, keys and logins.
- Everything in Personal, for every member
- Shared vaults with use, reveal and manage access
- Vault-wide rules: approve every use, choose which agents may ask
- Audit trail for owners and admins, and a rotation list when someone leaves
- Agent access by role: [LIMIT] connected agents per person
Compare
Compare every feature.
Numbers are the limits each vault has today. Scroll sideways on a small screen.
| Feature | Personal[PRICE] | Organization[PRICE] |
|---|---|---|
| Items | ||
| Logins, with one-time codes | ||
| Websites per login | 10 | 10 |
| Servers: addresses · services · logins, per server | 10 · 12 · 10 | 10 · 12 · 10 |
| SSH, TLS, PGP and service-account keys | ||
| API secrets | ||
| Signing keys held in AWS KMS, per person | 3 | 3 |
| Cards and identitiesAlways in your personal vault, never shared | ||
| Secure notes | ||
| Files per item, up to 1 MB each | 10 | 10 |
| Deleted items kept in the trash | 30 days | 30 days |
| Password health and breach check | ||
| Apps and devices | ||
| Mac app (Apple silicon) | ||
| Windows app (64-bit) | Coming soon | Coming soon |
| Linux app (64-bit) | Coming soon | Coming soon |
| Chrome extensionFills logins, identities and cards | ||
| Android: Vaarta AuthenticatorYour approvals and one-time codes | ||
| Browsers and computers per person | 10 | 10 |
| Device-only itemsStay on one computer, never on our servers | ||
| Every request signed by the device's own key | ||
| Sharing and sync | ||
| Personal vault on all your devices | Included, for every member | |
| Shared organization vaultsOwned by the organization, they outlive any member | ||
| Access per vault: use, reveal or manage | ||
| Move one of your items into a shared vault | ||
| Rotation list when someone leavesEvery item they could see, with the date they last saw it | ||
| Encrypted export of your personal vault | ||
| Security and approvals | ||
| Unlocks and cards approved on your phone, with number matching | ||
| Each item sealed with its own key | ||
| A card field shows after a fresh tap, for | 60 seconds | 60 seconds |
| Every reveal recorded | ||
| Vault-wide rules: approve every use, choose allowed agents | ||
| Audit trail for owners and admins | ||
| Admins cannot read content quietlyAdding themselves to a vault is recorded and notified | Not applicable | |
| AI agents (MCP) | ||
| Connected agents per person | [LIMIT] | [LIMIT] |
| Agents see titles only | ||
| Call an API with a secret it never sees | ||
| Sign with your key without seeing it | ||
| Signatures per key, per day | 500 | 500 |
| Longest approval you can give an agentSigning: 24 hours at most | 30 days | 30 days |
| Who may connect agents | You | Set by role |
| See each agent's activity; disconnect one or all | ||
| Import | ||
| Google Passwords, Apple Passwords, Bitwarden, 1Password | ||
| LastPass, Firefox, Edge, Brave, Dashlane, Proton Pass, NordPass, Enpass, KeePass, KeePassXC | ||
| Any CSV, matching the columns yourself | ||
| Each import file, up to | 2,000 rows · 5 MB | 2,000 rows · 5 MB |
| Support | ||
| Help centre | [SUPPORT] | [SUPPORT] |
| Email support | [SUPPORT] | [SUPPORT] |
| Help moving your team in | [SUPPORT] | [SUPPORT] |
Questions
Questions, answered.
Something else? .
Can anyone open my vault without my phone?
Unlocking on a computer or in Chrome takes a number match on your phone, and the unlock lasts five minutes at most. A card asks again every time. A request you did not start cannot be approved by accident, and every reveal is recorded.
What does an AI agent actually see?
Titles, types and the sites an item is for. Never a password, a username, a key or a card. When it needs to use something, it asks, you approve on your phone, and the vault does the work and returns only the result.
What happens to my agents if our plan changes?
Your earliest-connected agents keep working, up to the new plan's number. Disconnecting an agent is always allowed, on any plan.
Do my cards go into the organization's vaults?
No. Cards and identities live only in your personal vault and are never shared, not with your organization and not with an agent.
What happens to shared items when someone leaves?
Shared vaults belong to the organization and stay. Their access ends, and every item they could reveal appears on a rotation list, with the date they last saw it.
Can I take my things with me?
Yes. Export your personal vault as one file sealed with a passphrase you choose (at least 12 characters). One-time-code keys and cards come along only if you choose them and confirm.
How does the breach check stay private?
Only the first five characters of the password's hash leave. The answer lists every breached hash with that prefix, padded, and the match is made on our side. Your password is never sent.
Which computers can I use today?
The Mac app (Apple silicon), Chrome and Vaarta Authenticator on Android. The Windows and Linux apps are coming.
Put every secret behind one tap.
Create your vault, link your phone, and bring everything in.