Every reveal
leaves a trail.
A server-side encrypted credential vault built into the same platform as everything else — not a bolted-on Keeper or LastPass integration. Real breach checking, real key rotation, and an honest line about what “encrypted” does and doesn’t mean here.
Six record types. One audited chokepoint.
Every reveal calls the same decrypt-for-display function, and every one of those calls writes a hash-chained audit entry. There’s no side door.
TOTP records go further still: the rotating 6-digit code is fetched freely, but the re-enrollable QR/seed stays hidden unless you explicitly ask for it — and that ask gets its own audit flag.
Rotate the master key without re-encrypting a thing.
Rotating the master key re-wraps every tenant’s small data-encryption key, not the underlying secrets — a rotation that takes seconds, not a re-encryption job that takes hours.
Offboarding a tenant for good has its own path, deliberately irreversible: delete the DEK, and the ciphertext left behind is permanently unrecoverable — cryptographic shredding, not a soft delete.
Know before your client’s ex-employee does.
BreachWatch checks vaulted passwords against Have I Been Pwned without ever sending a full password or its full hash anywhere.
Need a key pair instead of a password? Generate SSH keys or a self-signed certificate without leaving the vault, with expiry alerts before a cert quietly lapses.