Credential Vault

What it is

The Vault is an encrypted store for a customer's credentials and secrets, kept next to the customer they belong to. Values are encrypted at rest, and a secret is only shown when someone asks to reveal it, with every reveal recorded.

How it works

• Store an entry for a customer. Sensitive fields are encrypted, so the raw value is never held in plain text.
• When you need a secret, choose to reveal it. Each reveal is written to an access log that records who viewed it and from which IP address.

Good practice

Only reveal a secret when you actually need it. Because every reveal is logged with the user and the time, the Vault gives you a complete audit trail of who has seen each credential, which is important for security reviews and for demonstrating control to customers.