Organization vaults
Owned by the organization, so they stay when people go. Their items are sealed under the organization's own encryption context.
Teams and sharing
Share the server, not the password.
Organization vaults belong to the organization and outlive any member. Give people and teams use, reveal or manage, and know exactly what to rotate when someone leaves.
Production servers
Organization vaultAccess for the Platform team
useUse an item without seeing its values.
revealAlso see its values.
manageAlso add, edit and set access.
Why it matters
Shared secrets are usually copied secrets.
Use without seeing
With use, a teammate fills and uses a credential without ever reading it.
Admins are not readers
Governing a vault does not grant reading it, and an admin adding themselves is recorded and announced.
Leaving is a checklist
When someone leaves, every item they could reveal becomes a rotation prompt with the date they last saw it.
How it works
When someone leaves.
- Owner1Removes the memberFrom the organization, or offboarding runs it.
- Vault2Access endsEvery grant they held on shared vaults stops.
- Vault3Builds the listEach item they could reveal, with the date they last revealed it.
- Owner4RotatesA prompt per item. Nothing rotates without you.
The exact mechanisms
Access, rules and records.
Use, reveal, manage
Three levels, each including the one before, given to members or to teams.
use < reveal < manage
Governing is not reading
Owners and admins govern a vault by default; that alone gives no read access. An admin who adds themselves with reveal or manage is recorded as a critical event, and the vault's managers and the organization's owners are told.
self_add recordedmanagers notified
Vault-wide rules
Per shared vault: approve every use, and choose which agents may ask, up to 100, or any.
approve_every_useallowed agents ≤ 100
Move an item in
Move one of your items into a shared vault you manage. Ownership passes to the organization. Cards and identities never move.
Audit trail
Readable by the organization's owners and admins, never by another organization.
Rotation list
Every item a leaver could reveal, with the date they last saw it. A prompt, never an automatic rotation.
last_revealed_at
Which roles connect agents
Early accessThe organization decides which roles may connect AI agents, and each shared vault decides which agents may ask.
In which planOrganization vaults come with the Organization plan.See plans →
See plansPut every secret behind one tap.
Create your vault, link your phone, and bring everything in from where it lives today.