AES-256-GCM · RBAC · Multi-tenant

Password security built
for the way teams actually work.

Give every employee a private vault, keep company credentials under admin oversight, and control access as your team grows and changes — enforced at the database, not just the UI.

No credit card required · Cancel anytime

Team Vault
encrypted
  • GitHub

    sarah@acme.co

    ••••••••
  • AWS Console

    ops@acme.co

    ••••••••
  • Figma

    design@acme.co

    ••••••••
Decrypted server-side · Auto-hidden in 10s
AES-256-GCMRow-level securityMulti-tenant RBACEncrypted at restInstant revocation
How it works

From zero to secure in three steps.

01

Create your organization

Spin up a tenant in seconds. You become the first admin.

02

Invite your team

Send secure invite links. Assign admin or user roles per person.

03

Store, share, revoke

Employees save their own credentials. Admins see everything. Blocking a member is instant.

Security

Defense-in-depth, not defense-in-marketing.

Every layer — from the encryption primitive to the RLS policy — is doing real work. Here's what's under the hood.

AES-256-GCM encryption

Per-row initialization vectors and additional authenticated data binding org_id:password_id. Tampering fails decryption.

Zero plaintext at rest

Encryption and decryption happen inside TanStack server functions using Node crypto. Your database only ever sees ciphertext.

Postgres RLS isolation

Row-level security enforces per-user and per-org boundaries at the database — not a middleware layer that can be bypassed.

Instant offboarding

Set a member to blocked and every one of their queries starts returning empty. No cache to purge, no session to invalidate.

Strong password generator

Cryptographically random via Web Crypto. Length, symbols, and character-class toggles — built into the create dialog.

Auto-hide reveal

Revealed passwords disappear from screen after 10 seconds. One-tap copy to clipboard for the moments in between.

Trust

Built to enterprise expectations.

Encryption at rest — AES-256-GCMGDPR-aware data handlingSOC 2 controls — roadmapRLS-enforced tenant isolation

Items marked "roadmap" are actively being pursued and are not yet certified.

Pricing

Simple, flat pricing per organization.

No per-seat surprises. One plan covers your whole team.

MonthlyAnnual (save ~15%)

Team

For growing teams that need real security today.

$4.99/mo
  • Up to 25 members
  • Unlimited credentials
  • AES-256-GCM encryption
  • Admin master vault view
  • Email invites & instant revocation
Most popular

Business

For established organizations with compliance needs.

$9.99/mo
  • Unlimited members
  • Everything in Team
  • Priority support
  • Audit log (roadmap)
  • SSO (roadmap)

Prices in USD. Billing powered by Stripe — coming soon during checkout.

FAQ

Questions, answered.

Start securing your team's credentials today.

Stand up your organization in under a minute, invite your team, and keep every credential encrypted and under your control.