Stop leaking secrets.
Start managing them.
Encrypted. Versioned. Audited.
A purpose-built secrets management platform for modern applications. Environment-scoped, version-controlled, and encrypted at rest with AES-256-GCM — plus a complete audit trail of every access.
The Problem
Your secrets deserve better than
a .env file in source control.
Teams scatter secrets across .env files, CI variables, sticky notes, and Slack DMs. No versioning. No audit trail. No access control. One leaked credential, and you're on the front page for all the wrong reasons.
HashiCorp Vault
Complex to self-host. Requires dedicated infra team. Unsealing ceremonies. Steep learning curve for developers.
.env Files in Git
Secrets committed to source control. No versioning. No access control. One leak exposes everything.
Cloud Provider KMS
Vendor lock-in. Different API per cloud. No cross-environment workflow. Priced per API call at scale.
You need encryption, versioning, and audit — without the operational burden.
Security Architecture
Built for zero-trust.
Designed for developers.
Immutable Version History
Every update creates a new immutable version. Browse the full history of any secret, compare changes, and restore previous values with a single API call. Never lose a configuration again.
Environment Isolation
Scope secrets by project and environment — development, staging, production. Each environment is completely isolated with its own access controls. Default environments created automatically.
Service Account Authentication
Generate scoped API keys for your CI/CD pipelines, servers, and services. SHA3-256 hashed, prefix-identifiable (vts_*), with optional expiration dates. The raw key is shown once — we only store the hash.
Fine-Grained Access Policies
Allow/deny policies per user, service account, or role. Scope to project, environment, or individual actions (read, write, delete, rotate). Deny always wins over allow.
Append-Only Audit Trail
Every operation is recorded: who accessed what, when, from which IP, with which user agent. Immutable, tamper-proof, and queryable. Built for SOC 2 and ISO 27001 compliance.
AES-256 Envelope Encryption
Every secret value encrypted with AES-256-GCM before touching storage. Data encryption keys wrapped by a master key. The platform physically cannot read your secrets in plaintext.
Getting Started
From zero to managed secrets in 3 minutes.
Create a Project
Organise secrets by project. Each project automatically gets development, staging, and production environments.
Generate a Service Account
Create a scoped API key for your application. Choose read, write, or admin access. The key is shown once — store it securely.
Store & Retrieve Secrets
Write secrets via API. Read them at runtime. Every access logged. Every change versioned. No .env files needed.
Developer Experience
A REST API you'll actually
enjoy using.
Clean, predictable endpoints. Bearer token auth with service accounts. JSON responses. No SDK required — works with any HTTP client in any language.
curl -X POST https://api.vyntech.com/v1/secrets/envs/{envID}/secrets \
-H "Authorization: Bearer vts_a1b2c3d4e5f6..." \
-H "Content-Type: application/json" \
-d '{
"name": "DATABASE_URL",
"value": "postgres://user:pass@host:5432/db"
}'curl https://api.vyntech.com/v1/secrets/envs/{envID}/secrets/DATABASE_URL \
-H "Authorization: Bearer vts_a1b2c3d4e5f6..."
# Response:
{
"name": "DATABASE_URL",
"value": "postgres://user:pass@host:5432/db",
"version": 3,
"updated_at": "2026-07-26T08:30:00Z"
}Use Cases
Built for how
teams actually work.
CI/CD & Deployments
Inject secrets into GitHub Actions, GitLab CI, or Kubernetes without storing raw credentials in CI config.
Multi-Environment Apps
Keep development, staging, and production secrets cleanly isolated. Zero cross-environment leakage.
Team Collaboration
Onboard new engineers in seconds. Grant scoped access without sharing master passwords over Slack.
SOC 2 & ISO 27001
Satisfy compliance requirements with immutable audit logs, RBAC policies, and envelope encryption.
Secret Rotation
Rotate API keys and database credentials with automated versioning and instant rollback capability.
Multi-Cloud Workloads
One unified secrets API across AWS, Azure, GCP, and bare metal. No per-cloud KMS lock-in.
Trust & Compliance
Security isn't a feature. It's the foundation.
Encryption at Rest
Authentication
Authorisation
Observability
Pricing
Free to start. Scales with you.
Free
Perfect for side projects and small teams.
Team
For growing teams with compliance needs.
Enterprise
For organisations with strict compliance requirements.
FAQ
Frequently asked questions.
Everything enterprise teams need to know before adopting Vyntech Secrets.
Every secret is encrypted with AES-256-GCM using a unique data encryption key (DEK). DEKs are wrapped with a master key stored in an isolated key management service. Plaintext secrets never touch disks or swap space unencrypted.
Every API call that touches a secret is logged with the actor (user or service account), action performed, resource affected, IP address, user agent, and timestamp. The audit log is append-only and immutable — entries cannot be modified or deleted. Retention depends on your plan.
The Enterprise plan includes an on-premise deployment option. You provide the infrastructure (PostgreSQL + a Linux server), we provide the binary and support. Your master encryption key never leaves your network.
Policies are evaluated in deny-wins order. If any policy explicitly denies an action, it's blocked regardless of allow policies. This ensures you can set broad access and surgically restrict specific environments or secrets.
The immutable audit trail, encrypted storage, and RBAC access controls satisfy evidence requirements for SOC 2 Type II, ISO 27001, GDPR Article 32, and HIPAA technical safeguards. We provide a compliance mapping document on request.
Vault is a powerful but operationally complex tool — unsealing, HA clustering, and storage backends require a dedicated team. Vyntech Secrets is a managed service with a simpler developer experience: REST API, environment scoping, and zero operational burden. No unsealing, no infra to manage.
Your .env files are a liability.
Replace them today.
Free tier includes 100 secrets, 3 projects, and full encryption. No credit card required. Set up in under 3 minutes.
Vyntech Pty Ltd · Australia
Your secrets. Encrypted at rest. Audited always.