Envelope-encrypted, audit-logged storage for the credentials, keys, and customer data your app can't afford to leak. One REST API, no infrastructure to run.
This is envelope encryption: your data is never protected by one key alone. Even if our database leaked in full, there's nothing readable inside it.
The secret you send — an API key, a password, a customer record — exists unencrypted for microseconds, never on disk.
Every secret is sealed with its own random key. Compromising one record never exposes any other.
The DEK itself is wrapped by a key that lives only in server memory. A stolen database backup is useless without it.
The parts every serious secrets store needs — done once, so you don't have to.
Per-record keys wrapped by a master key that's never persisted.
Rotate your master key; old records migrate forward automatically.
Every read and write is logged in an append-only chain that detects any alteration.
Google Authenticator–compatible MFA on top of JWT and API-key auth.
HSTS, strict CSP, and modern cipher suites enforced at the edge.
Issue and revoke keys per service — never share one credential everywhere.
Per-IP throttling on every endpoint, out of the box.
No legacy bcrypt or unsalted hashes anywhere in the auth path.
Register, store, retrieve — decrypted automatically for an authenticated caller.
# 1. Register and get a token curl -X POST vault.denniscreatives.com/v1/auth/register \ -d '{"email":"[email protected]","password":"..."}' # 2. Store a secret — encrypted before it touches disk curl -X POST vault.denniscreatives.com/v1/vault \ -H "Authorization: Bearer $TOKEN" \ -d '{"label":"mpesa-key","data":"till-3293102-secret"}' # 3. Retrieve it — decrypted for you, nobody else curl vault.denniscreatives.com/v1/vault/{id} \ -H "Authorization: Bearer $TOKEN"
Start free. Upgrade when your traffic does.
500 requests a month, one API key, no card required.
By creating an account you agree to our Terms and Privacy Policy.
Here's your API key — it's shown once.