Illustration: a value is sealed in the browser; the server and storage hold only sealed envelopes

The server runs the service; the browser handles secret values

The server checks who is asking and stores encrypted records. The signed-in browser unlocks the vault keys in session memory and encrypts each supported secret before it is saved.

Explore the security model

Control each step of the credential lifecycle

Store, use, share, review, and recover records from the console on your own server.

Why VaultPilot · Solutions

Passwords, API keys and certificates

Keep passwords, API keys, and certificates masked until an authorized user reveals or copies them, and get a warning before a certificate expires.

Vault records

Browser extension

Pair named Chromium devices for autofill and save prompts, and revoke a device when needed.

Browser extension

Encrypted sharing

Share selected records internally or in passphrase-protected packages with expiry controls.

Sharing

Directory context

Sync approved Active Directory metadata through an optional agent that you enroll.

Active Directory

Audit history

See who did what and when for sign-in, vault, sharing, and configuration events; each event is chained to the one before it.

Audit history

Backup and recovery

Keep Quick Recovery separate from a full server backup, and match the recovery file to the failure.

Backup and recovery

Review possible credential exposure without collecting passwords

Approved users can check login pages on private networks, TLS weaknesses, and authorized files that may hold credentials outside the vault. Discovery only reads. It stores redacted findings, never tries a password, and never changes a source file.

Explore Discovery