Vault: company passwords and secrets

Two parts, two jobs

Open Vault. It has two tabs:

• Passwords: a company password manager for people. It works in browsers and on phones.
• Secrets: API keys and environment variables for your apps and services, organised by project and environment.

If the password part has not been installed by your provider, the page says so, and the Secrets tab still works.

Passwords

The Passwords page opens with a step-by-step guide, Get set up (about five minutes):

1. Sign in with your company account: open the vault address shown on the page, enter your work address and choose Use single sign-on. You sign in with your PGB Business account.
2. Set your master password. It encrypts your vault on your device and is never sent to anyone. Make it long, such as a short sentence, and write it down somewhere safe.
3. Install the app you prefer on your browser, phone or computer. The page lists links by device.
4. Share with your team: shared passwords live in your workspace's organization. Your administrator invites you by email; accept it and the team's collections appear beside your own items.

The vault is zero-knowledge: everything is encrypted on your device with your master password. Nobody else can read it, including your administrator, and nobody can recover it if you forget the master password.

Personal items stay private even inside an organization. Only items saved to a collection are shared.

Administering the vault

In Admin, the Vault tab lets administrators register the vault for single sign-on and create a New organization. Once it exists, invite staff to join it and put shared passwords in collections for each team (for example Finance or Support). Remove a leaver's access promptly.

Secrets

The Secrets tab is for application keys, not people's passwords.

1. Choose New project and name it, for example "Website" or "Billing API".
2. Choose an environment tab for the project (each tab shows how many secrets it holds).
3. Choose Add secret, give it a name in the style PAYMENTS_API_KEY, and a Value. Set Rotation days if the key must be changed regularly.
4. Use Import .env to bring in a whole file, or Export to take one out.

Values stay hidden until someone chooses reveal. A revealed value hides again after 30 seconds. Copy puts it on your clipboard. Each secret keeps its last 20 values, and revealing an old one is logged too.

Every reveal and export goes into the project's Access log, which administrators can open. Use Members (administrators) or the Project members control to decide who can see or change a project.

Service tokens

For CI or a server, choose Service tokens, give the token a name such as "Deploy pipeline" and pick one environment. A token lets a server read that single environment as a .env file. It cannot change anything, and every read is logged. Copy it immediately, because it is shown only once. Use Revoke if it leaks.

Note: Secrets are encrypted one by one, but the key that protects them is held by the PGB Business server. They are not zero-knowledge like personal passwords, so put people's own logins in Passwords.

Habits

• Never paste a key into chat, a document or an email. Put it in Secrets.
• Rotate keys on a schedule.
• Review the Access log after an incident.
• Give each person the least access they need.