Contracts that fit
Seats, vaults and storage are set per agreement, with an append-only ledger of every amendment.
- Minimum seats
Secrets and passwords your team can trust — and prove still work.
One platform for people and machines. PulsVault checks that stored credentials still authenticate, hands CI pipelines scoped keys instead of shared ones, and keeps a tamper-evident record of security-relevant actions.
Enterprise is arranged by contract with our team — there is no self-serve checkout.
- Client-side encryption of sensitive fields
- Hash-chained audit trail
- Scoped machine access
pulsvault.com/console/validators
continuous-validation.log
- 14:58:33[PROBE]Testing 42 credentials in northwind/production
- 14:58:36[SUCCESS]stripe-api-key — authenticated, scope unchanged
- 14:58:41[SUCCESS]github-pat — authenticated, expires in 54 days
- 14:58:49[FAILED]postgres-primary — authentication rejected
- 14:58:49[TRIGGER]Alert routed to #security · postgres-primary
A backup you can open without us
Your organization’s own copy of what it keeps in PulsVault, encrypted to keys only you hold and delivered to storage you own. If we were ever unavailable, you would still have it.
Built every night
Your organization’s settings, DevOps secrets, company vaults and audit log are gathered into one archive. You can also build one on demand.
Encrypted to your keys
Sealed with the age public keys you register. We never hold a private key, so we cannot open an archive — and neither can anyone reading your bucket.
Delivered to your bucket
Written to an S3-compatible bucket you own. We only write there; we never list, read or delete.
Opened without us
Decrypt it with the free age tool, and read company vault items offline with the recovery kit, a single web page you keep.
Choosing where archives go needs its own permission that is part of no role. A change waits 48 hours and is announced to every administrator.
An audit trail that can be checked
Tamper-evident, not tamper-proof: a change to the record is detectable. It is designed to support evidence for SOC 2, ISO 27001 and GDPR Article 30, and it records security-relevant actions rather than every read.
Hash-chained
Security-relevant actions are chained to the entry before them, so an altered or removed entry is detectable.
Append-only storage
The application’s own database login cannot delete audit rows.
Verified before any purge
Retention purges verify the chain first and only remove what they verified.
Signed receipts
Signed integrity receipts, also placed in every backup archive, let you prove the log’s state offline.
Streamed to your monitoring
Forward events over a webhook, signed with HMAC-SHA256 when you configure a secret.
Built for contracts and scale
Enterprise keeps everything in Business and adds the limits, terms and ownership that large organizations negotiate.
The highest ceilings
The highest machine-plane limits, the fastest credential re-checks and the longest machine history of any plan.
- Secret reads per key
- Secret reads per space
- Fastest re-check
- Machine history
- Versions per secret
The longest retention
Audit history, trusted devices, item history and vault backups at the Enterprise tier.
- Audit history
- Trusted devices
- Item history
- Vault backups kept
Your name on it
Show your organization’s name, logo and accent colour to your members.
Isolated at the database
Organization data is separated with row-level security in the database, in addition to the checks in the application.
Everything in Business
Company-owned vaults, role-based access, policy suite, network policy, Access Report and the machine plane all carry over.
Security that keeps up with your infrastructure
Beyond storing passwords: PulsVault verifies credentials, issues machine access with the least privilege it needs, and lets engineering and security work from the same source of truth.
Continuous credential validation
Probes check on a schedule that stored database, API-token and HTTP credentials still authenticate, for services reachable over the public internet. A failing credential raises an alert you can route to Slack, a webhook or email.
Machine identities for CI
Pipelines get their own scoped API keys, pinned to a project and limited by path patterns — no shared admin token. Load secrets in GitHub Actions or GitLab CI with the pulsvault CLI.
Secrets with history
Namespaced key–value secrets per project and environment, with every change versioned and a point-in-time restore you preview before it applies.
- Versions kept per secret
People and machines, one console
Team password vaults, pipeline secrets and delegated tasks are managed from one console, so a rotation can be assigned, tracked and closed where the secret lives.
Complete control. Complete visibility.
The controls a security team asks for in its first week — who has access, what they can reach, and how the data is protected.
Lifecycle and provisioning
Invite, assign roles, suspend and remove from one roster. Removing a member closes their account in your organization and ends their access; vaults they could open are flagged for key rotation.
Policies and network limits
Enforce password, two-factor and session rules, choose which ciphers vaults may use, and restrict where members can sign in from.
Access Report
See who can reach what, by member or by resource, with the route each grant takes.
Envelope encryption
Each vault has its own key, wrapped by your master key, which is wrapped by a key derived on your device. Removing someone rotates the vault key on the client.
On the roadmap
Not available today. They are listed so you can see where we are heading, and so we are never vague about what is and is not shipped.
SSO and SCIM
Single sign-on and automated user provisioning from your identity provider.
On the roadmap OIDC workload identity
Let CI jobs authenticate with short-lived identity tokens instead of stored keys.
On the roadmap AI-agent identities
Scoped identities for AI agents, alongside machine identities.
On the roadmap
Client-side encryption. Your keys.
Sensitive fields are encrypted on your device. The server stores ciphertext and wrapped keys — never your password, your vault keys or the plaintext of those fields — so a breach of our servers does not expose them.
Vault keys are derived locally from your password and a separate Access Key. Vaults use AES-256-GCM (ChaCha20-Poly1305 is available too), with a fresh nonce for every encryption. Item titles and other non-sensitive fields are not end-to-end encrypted, and DevOps secrets are decrypted by our servers when an authorised machine key reads them.
Client-side encryption
Sensitive fields are encrypted before they leave your device. Only your devices hold the keys that decrypt them.
AES-256-GCM
Authenticated encryption with a unique nonce for every encryption and bound associated data.
Two-gate access
Signing in and unlocking the vault are separate steps; the vault key is derived on the device and never sent.
Tamper-evident audit
A hash-chained audit trail designed to support evidence for SOC 2, ISO 27001 and GDPR Article 30.
Questions security teams ask first
Talk to us about Enterprise
Tell us about your organization and what you need to prove. Our team will get back to you about terms.
Talk to an expert