Secrets your servers fetch, never store.
EasyVault keeps passwords, API keys and certificates behind envelope encryption and serves them over a HashiCorp Vault–compatible API. Services hold only a scoped, short-lived token and read what they need at runtime, so there is nothing on their disks to steal.
No single stored value can decrypt anything.
Every secret is sealed under its vault's key, every vault key is wrapped per member, and the key that ties it together lives only in RAM. Steal the database and you have ciphertext.
Each layer unlocks only the one below it, and only in memory.
A blind master
The master account creates vaults and users and escrows their keys, but can't read a single secret. Administration and access stay separate.
Scoped credentials
Every token and AppRole is limited by path, client IP or CIDR and TTL, and can be issued read-only. The raw token is shown once; only its hash is kept.
Rotation on revoke
Removing a member generates a new vault key, re-encrypts every secret and re-wraps it for everyone who remains, in one transaction.
Tamper-evident audit
Every read, write, denial and admin action is logged with an HMAC over the row. The audit viewer flags any entry that was edited. Values are never logged.
Burn after read
Cap a secret at N reads. After the last one its ciphertext is wiped and the next request gets a 404 — made for one-time credentials.
Emergency seal
One button drops the master key from memory. Every token stops working and every session is locked out until the shares are presented again.
People in the browser. Machines over the API.
Teams manage vaults, members and secrets in the Web GUI. Services and pipelines get a credential scoped to exactly what they read, and existing Vault clients keep working.
Vault-compatible KV v2
Read, write, list and delete under /v1/secret with an X-Vault-Token, in Vault's own response envelope.
Every write is a version
Nothing is overwritten. The GUI shows the current value and the history behind it, and a new version is one click away.
Per-vault tokens
Allowed paths, allowed IPs, a TTL and read-only or read-write access. Renewable tokens can look up, renew and revoke themselves.
AppRole for CI
Pipelines trade a role_id and secret_id for a short-lived token. No long-lived credential in the build config.
Roles per vault
Admins manage members and rotate keys, editors write secrets and issue credentials, viewers read. Access is granted vault by vault.
Bounded audit log
Set a retention window and old events are pruned on a schedule, or immediately with Prune now. Integrity is checked on every row shown.
One binary between your services and their secrets
Services and pipelines authenticate with a token or an AppRole. EasyVault checks what that credential may reach, unwraps the vault key for the one request, and returns the value. Only ciphertext ever reaches the disk.
Running in minutes. Upgraded like everything else.
EasyVault installs from the signed EasySYS package repository as a hardened service, and upgrades through the package manager you already use. The installation guide has the details.
Start with one vault.
Move one service's credentials into EasyVault and give it a read-only token. MIT licensed and developed in the open.