Somewhere to put the things that don't belong in a repo.

Deploy scripts, .env files, API keys, the runbook nobody wrote down. Encrypted before storage, shared with exactly who you choose.

Encrypted per item

AES-256-GCM with a separate key for every secret, wrapped by a master key that never touches the database.

Four ways to share

The whole org, one team, one person, or nobody. Private means private — org owners can't read your items either.

Nothing is overwritten

Every save keeps the previous version. Read any of them back, or delete an item outright when a secret is burned.

Every access recorded

Who viewed what, when, and from where — visible to admins, without exposing the names of anyone's private items.