Stop leaking secrets.
Start managing them.
Encrypted. Versioned. Audited.
A purpose-built secrets management platform for modern applications. Environment-scoped, version-controlled, and encrypted at rest with AES-256-GCM — plus a complete audit trail of every access.
The Problem
Your secrets deserve better than
a .env file in source control.
Teams scatter secrets across .env files, CI variables, sticky notes, and Slack DMs. No versioning. No audit trail. No access control. One leaked credential, and you're on the front page for all the wrong reasons.
HashiCorp Vault
Complex to self-host. Requires dedicated infra team. Unsealing ceremonies. Steep learning curve for developers.
.env Files in Git
Secrets committed to source control. No versioning. No access control. One leak exposes everything.
Cloud Provider KMS
Vendor lock-in. Different API per cloud. No cross-environment workflow. Priced per API call at scale.
You need encryption, versioning, and audit — without the operational burden.
Security Architecture
Built for zero-trust.
Designed for developers.
Every layer engineered with least-privilege access, cryptographic isolation, and complete observability.
Immutable Version History
Every update creates a new immutable version. Browse the full history of any secret, compare changes, and restore previous values with a single API call. Never lose a configuration again.
Environment Isolation
Scope secrets by project and environment — development, staging, production. Each environment is completely isolated with its own access controls. Default environments created automatically.
Service Account Authentication
Generate scoped API keys for your CI/CD pipelines, servers, and services. SHA3-256 hashed, prefix-identifiable (vts_*), with optional expiration dates. The raw key is shown once — we only store the hash.
Fine-Grained Access Policies
Allow/deny policies per user, service account, or role. Scope to project, environment, or individual actions (read, write, delete, rotate). Deny always wins over allow.
Append-Only Audit Trail
Every operation is recorded: who accessed what, when, from which IP, with which user agent. Immutable, tamper-proof, and queryable. Built for SOC 2 and ISO 27001 compliance.
AES-256 Envelope Encryption
Every secret value encrypted with AES-256-GCM before touching storage. Data encryption keys wrapped by a master key. The platform physically cannot read your secrets in plaintext.
Getting Started
From zero to managed secrets in 3 minutes.
Create a Project
Organise secrets by project. Each project automatically gets development, staging, and production environments.
Generate a Service Account
Create a scoped API key for your application. Choose read, write, or admin access. The key is shown once — store it securely.
Store & Retrieve Secrets
Write secrets via API. Read them at runtime. Every access logged. Every change versioned. No .env files needed.
Developer Experience
A REST API you'll actually
enjoy using.
Clean, predictable endpoints. Bearer token auth with service accounts. JSON responses. No SDK required — works with any HTTP client in any language.
curl -X POST https://api.vyntech.com/v1/secrets/envs/{envID}/secrets \
-H "Authorization: Bearer vts_a1b2c3d4e5f6..." \
-H "Content-Type: application/json" \
-d '{
"name": "DATABASE_URL",
"value": "postgres://user:pass@host:5432/db"
}'curl https://api.vyntech.com/v1/secrets/envs/{envID}/secrets/DATABASE_URL \
-H "Authorization: Bearer vts_a1b2c3d4e5f6..."
# Response:
{
"name": "DATABASE_URL",
"value": "postgres://user:pass@host:5432/db",
"version": 3,
"updated_at": "2026-07-26T08:30:00Z"
}Use Cases
Built for how
teams actually work.
CI/CD Pipelines
Inject secrets into your build and deploy pipelines. Scoped service accounts per environment ensure production secrets never leak to development.
Microservice Configuration
Each service gets its own service account with read-only access. Secrets fetched at boot — no filesystem exposure, no environment variable inheritance.
Database Credentials
Rotate database passwords without redeploying. Update the secret, services pick up the new value on next read. Version history preserves the old credentials.
API Keys & Tokens
Store third-party API keys centrally. When a vendor rotates their key, update once — all services consuming it get the new value automatically.
Compliance & Audit
Demonstrate to auditors exactly who accessed which secret, when, and from where. Immutable logs satisfy SOC 2 Type II evidence requirements.
Multi-Tenant Platforms
Each tenant's secrets are cryptographically isolated. Cross-tenant access is architecturally impossible — separate encryption contexts per organisation.
Trust & Compliance
Security isn't a feature. It's the foundation.
Encryption at Rest
Authentication
Authorisation
Observability
Pricing
Free to start.
Scales with you.
Free
Perfect for side projects and small teams.
Team
For growing teams with compliance needs.
Enterprise
For organisations with strict compliance requirements.
FAQ
Frequently asked questions.
Everything enterprise teams need to know before adopting Vyntech Secrets.
Every secret value is encrypted with AES-256-GCM using envelope encryption. Each version gets a unique data encryption key (DEK), which is itself wrapped by a master key. The master key never leaves memory — it's loaded from config at startup and never persisted to disk.
Yes. The API is a standard REST interface with Bearer token auth. Create a service account with read scope, add the token to your pipeline's environment, and call the API at build or deploy time. Works with GitHub Actions, GitLab CI, Jenkins, CircleCI, and any tool that can make HTTP requests.
Secrets are soft-deleted — they're marked as deleted but not removed from storage. You can restore them via the API at any time. All previous versions are preserved and independently recoverable.
Each project gets isolated environments (development, staging, production by default). Secrets are scoped to a specific environment — a DATABASE_URL in production is completely separate from DATABASE_URL in development. Service accounts can be restricted to specific environments.
Secret values can be up to 64KB after encryption. This covers API keys, connection strings, certificates, and JSON configuration blobs. For larger payloads, consider storing a reference to an encrypted blob in object storage.
Every API call that touches a secret is logged with the actor (user or service account), action performed, resource affected, IP address, user agent, and timestamp. The audit log is append-only and immutable — entries cannot be modified or deleted. Retention depends on your plan.
The Enterprise plan includes an on-premise deployment option. You provide the infrastructure (PostgreSQL + a Linux server), we provide the binary and support. Your master encryption key never leaves your network.
Policies are evaluated in deny-wins order. If any policy explicitly denies an action, it's blocked regardless of allow policies. This ensures you can set broad access and surgically restrict specific environments or secrets.
The immutable audit trail, encrypted storage, and RBAC access controls satisfy evidence requirements for SOC 2 Type II, ISO 27001, GDPR Article 32, and HIPAA technical safeguards. We provide a compliance mapping document on request.
Vault is a powerful but operationally complex tool — unsealing, HA clustering, and storage backends require a dedicated team. Vyntech Secrets is a managed service with a simpler developer experience: REST API, environment scoping, and zero operational burden. No unsealing, no infra to manage.
Your .env files are a liability.
Replace them today.
Free tier includes 100 secrets, 3 projects, and full encryption. No credit card required. Set up in under 3 minutes.
Read the Documentation →Vyntech Pty Ltd · Australia
Your secrets. Encrypted at rest. Audited always.