Product

Password and secrets management, from storage to the moment of use

One console on your own server covers vault records, the paired browser extension, selected-record sharing, Discovery, audit history, recovery, and optional Active Directory metadata sync.

Explore the security model Open the live demo

Illustration: the vault ringed by browser, sharing, audit, directory, discovery, and backup

Passwords, API keys, notes, certificates, and files

A record stays masked until an authorized user reveals or copies its value. The browser encrypts the secret before the server stores it.

See vault records

Illustration: a drawer of vault records, each value masked, one record lifted out

A browser extension paired with each device

The Chromium extension fills a login only when you ask, offers to save or update records, and shows how many records match the active site. Each device pairs with a short-lived code and can be revoked from VaultPilot.

Read about the browser extension

Illustration: paired browsers fill a login form, and one device's pairing is revoked

Share selected records with VaultPilot users or outside recipients

Internal recipients use their registered identities. External recipients get a passphrase-protected package that opens in a local browser, with an expiry date and a maximum number of opens. You can revoke an internal share from VaultPilot; an external package cannot be recalled once sent.

Read about sharing

Illustration: a record shared with a colleague and a sealed, time-limited package for an outsider

Optional Active Directory metadata sync

The DC Agent sends directory metadata and health signals to VaultPilot. The AD bind password is entered at the agent’s local prompt and is not sent to VaultPilot. You control enrollment and reconciliation.

Read about Active Directory sync

Illustration: an agent beside the domain controller sends only directory metadata to the server

Discovery: a read-only review for secrets outside the vault

Approved users set the scope of each run: private IP ranges, TLS targets, and authorized local or SMB paths. A finding keeps a redacted excerpt and hashes, never the raw value. Only a file finding that a person has marked ready can be imported into a vault.

Read about Discovery

Illustration: folders on a network shelf reviewed with a magnifying glass, a few flagged for review

Audit history for supported actions

Sign-in, vault, sharing, extension, directory, update, and configuration events are recorded with the actor, target, role, and time. Each event carries its own hash and the hash of the event before it, so a reviewer can check the sequence.

Read about audit history

Certificate records with expiry alerts

Leaf certificates, chains, private keys, and PFX/P12 bundles are stored as encrypted vault records. VaultPilot reads X.509, PKCS#7, and PFX/P12 and alerts 15, 7, 3, and 1 day before expiry and on the expiry day while an authorized session has the vault unlocked.

Read about the certificate inventory

Active Directory password rotation

Rotation covers Active Directory credential records only. A connected DC Agent sets the new password in AD, and an authorized browser with the vault unlocked writes it into the encrypted record. Schedules run daily, weekly, monthly, or at a custom interval.

Read about AD password rotation

API clients, email notifications, and import

Through API clients the Owner sets up on the Integrations screen, approved systems read encrypted snapshots and status over a read-only API. SMTP sends selected audit events to chosen inboxes. Import reads export files from Bitwarden, LastPass, KeePass, 1Password, and Chrome or Edge.

See all integrations

All pages in Product

See VaultPilot in your own environment

Tell us what the evaluation should cover, or open the live demo with sample data first.

Why VaultPilot · Solutions