Secrets management with quantum-seeded keys.
Store, rotate and read infrastructure secrets through one API, with a per-secret encryption key derived from quantum entropy, per-principal access policies and an access audit trail. Keys are derived and held server-side — this is not zero-knowledge; we can read your secrets.
How Vault works
Where the trust sits: you send the plaintext secret to the API and it holds the key that decrypts it, so the operator can read your secrets. That buys you key management, rotation and audit you didn't have to build. If you need a vault that genuinely cannot read your data, you want client-side encryption — that is not what this is.
Storage: secrets, their wrapped keys and the access log are held in Postgres and survive restarts and redeploys. We do not yet publish a backup, restore or uptime commitment — if you need one contractually, ask us before you rely on it.
Quickstart — store and load a secret
A Python client and a qvault CLI exist in the repo, but neither is published to a package registry yet — pip install quantum-vault will not work. Use the API directly for now.
What Vault gives you
Quantum-seeded key derivation
A separate key per secret and version, derived with HKDF-SHA256 from QuantumRand entropy. Falls back to the OS CSPRNG if the entropy service is unreachable, and the response labels which was used.
Randomised rotation
Rotation runs on a base interval plus a random offset, so the moment of change isn't predictable. The offset comes from the OS CSPRNG, not the quantum source.
Tamper-evident access log
An append-only hash chain over every read, write and denial, so an altered entry breaks the chain and is detectable.
Per-principal policies
Access rules per secret and per principal, evaluated on every read, with denials recorded in the same audit chain.
Why route secrets through an API at all
The point is to stop secrets living in your repository and on developer laptops. Fetch them at boot over HTTPS instead, and you get one place to rotate a value, one access policy to change, and one log of who read what — none of which you had to build.
Pricing
- Team vaults + RBAC
- Tamper-evident access log
- Randomised rotation offsets
- Priority support
A free Developer tier is available in the product. Every tier uses the same cryptography; paid tiers raise limits and add team policies, rotation and the access log.