SkausWatch

Vault (Licensed Add-on)

A licensed secrets-management module: envelope encryption, JIT access, and certificate issuance.

  • AES-256-GCM envelope encryption with a fresh per-secret data-encryption key and a versioned, rotatable master key.
  • Just-in-time (JIT) access issues time-limited HMAC-signed tokens through an approval workflow; only the token's hash is ever stored.
  • One-time secrets support atomic, view-once retrieval — a second access attempt returns 410 Gone.
  • Cloud vault sync to AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and Kubernetes Secrets, plus X.509/SSH certificate issuance. Requires the skauswatch.vault flag and a matching license entitlement.

← Back to all features

Full technical documentation →