Engineering
Shared vault
- Items
- 38 items
- Members
- 4 members
AES-256-GCM
Team plan · 2 to 10 seats
Big security for small teams.
Share passwords, API keys and CI secrets without the chat threads and spreadsheets. One workspace for up to ten people, with roles, an audit trail and credential checks built in.
Cancel anytime.
pulsvault.com/console/vaults
Vaults
New vaultMarketing
Shared vault
- Items
- 21 items
- Members
- 3 members
AES-256-GCM
Finance
Shared vault
- Items
- 12 items
- Members
- 2 members
ChaCha20-Poly1305
Personal
PrimaryPrivate vault
- Items
- 17 items
- Members
- 1 member
AES-256-GCM
- Team size
- 2 to 10 seats
- Price
- Storage
- Free trial
From first invite to a team that runs itself
Four steps cover most of what a small team needs. Each one is something the Team plan already does.
Invite your team
Add people by email, up to ten seats on the Team plan. Seats are bought before the invitations go out, so the bill never surprises you.
Share a vault
Put the credentials a project needs in a shared vault and choose who can read, edit or manage it.
Hand secrets to your pipeline
Create a scoped machine key and read secrets from CI or with the pulsvault CLI — no .env file in the repository.
Keep an eye on it
Review the audit trail, spot weak or reused passwords, and see which stored credentials no longer authenticate.
What your team gets on day one
Everything below is included in the Team plan. Each card opens the details in a new tab, so you can keep this page where it is.
Shared vaults, scoped by team
Keep a project’s credentials in a vault the whole team can open, and give each team only the vaults it needs. Each person also keeps a private vault that only they can open.
Secure links
Send a password or note through a link that expires. The decryption key stays in the part of the address after the #, which browsers never send to us.
- Open links at once
Roles that fit your team
Create custom roles with exactly the permissions each job needs, instead of everyone being an admin.
- Custom roles
Grants on part of your secrets
Give a team read or write access to one branch of your secrets — staging, say — without opening the whole project.
Projects and tasks
Turn a vault into a project with ticket keys. Assign work to a teammate, point a task at a credential rather than pasting it, and require approval before it closes.
Secrets for your pipelines
Store secrets per project and environment, and let GitHub Actions, GitLab CI or the pulsvault CLI read them with a scoped machine key instead of a shared password. Machine keys are never billed as seats.
Know when a credential stops working
PulsVault checks that stored credentials still authenticate and shows which ones no longer do. Checks cover services reachable over the public internet.
- Fastest re-check
History you can restore
Every change creates a new version. Preview a restore before it applies, and see who deleted what.
- Versions kept per secret
Nightly backups, restored as new vaults
Your organization’s vaults are backed up every night. An administrator can take an extra backup before a big change and restore from it — always as a new vault, never over the live one.
- Backups kept
A calendar for the dates that can hurt you
API keys, role and share expiry, DevOps access policies, trusted devices, renewals and scheduled deletions on one timeline, counted by how soon they fall, with reminders before they lapse. Your own events and task deadlines sit alongside.
A security score for each person
Everyone gets their own dashboard: a score out of 100, ranked recommendations that show how many points each is worth, and an on-device scan for breached, weak, reused and stale passwords.
Team security posture
See weak, reused and old passwords across the team in one place, and what is coming up for rotation.
Passkeys and trusted devices
Sign in and unlock with a passkey. Devices you pair are trusted for a limited time, and you can see and remove them.
- Trusted devices
Choose the cipher per vault
Vaults use AES-256-GCM by default; on Team you can pick ChaCha20-Poly1305 for a vault instead.
Breach alerts
Get alerted when a stored login appears in a known data breach.
Keep .env files out of your repository
The pulsvault CLI reads a namespace and starts your command with those secrets in its environment. Use it locally, in GitHub Actions or in GitLab CI — the values never need to be written to disk.
Terminal
# See which variables a namespace would inject — names only, nothing runs
pulsvault run -n web-app/production/api --dry-run
# Start your app with those secrets in its environment
pulsvault run -n web-app/production/api -- npm startWhat stays private, and what doesn’t
A security product should be exact about its own limits. Here is where the boundaries are.
Sensitive fields are encrypted on your device
Passwords, notes and other sensitive fields are encrypted in your browser or app before they are sent. We store ciphertext and wrapped keys, not the keys that open them.
Not everything is secret to the server
Item titles and other non-sensitive fields are not end-to-end encrypted. We say so plainly so you can decide what belongs in a title.
Pipeline secrets are a separate boundary
Secrets you hand to CI are encrypted at rest and decrypted by our servers when an authorised key reads them — that is how a pipeline can use them. Scope the key and review the audit trail accordingly.
Growing past ten people?
Nothing here is a dead end. The next plans keep everything above and add what larger organizations are asked to prove.
Business
Up to 500 seats, audit integrity verification with signed receipts, SIEM streaming and longer audit retention.
Enterprise
Arranged by contract: negotiated limits, white-label branding and an organization backup archive encrypted to keys only you hold.