Self-hosted enterprise vault

A zero-knowledge secrets manager for teams that run Windows Server

VaultPilot installs on your Windows Server and is used from a browser over HTTPS. It holds your team’s passwords, credentials, API keys, secure notes, certificates, and file-backed secrets, and the server stores them only in encrypted form.

Architecture drawing of the browser, Windows Server and encrypted-storage trust boundary
Conceptual illustration of the browser, Windows Server, and encrypted-storage trust boundary

The server runs the service; the browser handles secret values

The server checks who is asking and stores encrypted records. The signed-in browser unlocks the vault keys in session memory and encrypts each supported secret before it is saved.

Explore the security model

Review possible credential exposure without collecting passwords

Approved users can check login pages on private networks, TLS weaknesses, and authorized files that may hold credentials outside the vault. Discovery only reads. It stores redacted findings, never tries a password, and never changes a source file.

Explore Discovery
Conceptual illustration of bounded discovery signals narrowing into reviewed evidence capsules