KeyvaciProduct
The credential vault your organisation controls,
and we cannot open
One product, one job: the shared logins, API keys and service accounts your team runs on, encrypted on each member’s own device so that what reaches us is ciphertext and nothing else.
Sign-in built for business
Sign in with the accounts your company already has
Sign in with the directory your company already manages, or with a verified work email if you do not run one. Same vault, same encryption, same price from day one.
Microsoft Entra ID
Anyone with a work account in your tenant can create the organisation, confirming on the record that they were authorised; Microsoft's signed tokens record whether they held Global Administrator. Verifying your domain over DNS reserves your company's name. Members then sign in with the accounts they already have, and suspending someone in Entra ID removes their Keyvaci access with it.
Google Workspace
Workspace organisations sign in with Google on the same terms: authority confirmed on the record, domain verified over DNS. Keyvaci asks Google for nothing beyond the sign-in identity. Personal Gmail is refused, because without a directory there is nothing to attach an organisation to. Okta and generic OIDC are next.
Email sign-in, for teams without a directory
Sign up with any work email, verified by a one-time link. Signing in is a link too, valid for five minutes and usable once, so there is no sign-in password to reuse, forget or steal. TOTP is optional, and an organisation can require it before any reveal.
Day-to-day
What your team gets
Vaults with three roles
Group credentials by system, client or team. Every member is a reader, a writer or an admin, and the server and the cryptography enforce the same rule.
Sharing with proof
Sharing seals the vault key for one recipient, and only after your device has verified the organisation's countersignature on their key. Signature fails, sharing stops.
Reveal with restraint
Revealing takes fresh authentication. Secrets hide themselves again after seconds, copies clear after 30, and rate limits stop a stolen session reading everything at once.
Search that stays local
Search vault and entry names instantly. The index is built by decrypting on your machine, because the server has nothing readable to search.
Password health
Set how many months a credential may go unchanged and stale entries are flagged. Master passwords face a strength check, not a lecture.
Five languages
English, Tiếng Việt, 日本語, 한국어, 中文, across the whole product, including every warning that protects your data.
Where it runs
Three clients, one implementation of the cryptography
A vault only works where the password is typed. The browser extension, the phone app and the web console are built from the same encryption and the same signature checks, not from three projects that have to be kept in agreement.
Browser extension
Chrome, Edge and Brave. Click a password field and the menu opens under it, offering only credentials that belong to that site. Keys erase after ten minutes, copies after 30 seconds.
iPhone and Android apps
The whole vault on the phone, plus a system password provider so Safari, Chrome and other apps fill from it. Locks the instant you switch away. Biometric unlock is optional and off until you choose it.
Web console
Every browser, nothing to install. Where administrators run members, grants, rotation, recovery and the audit log.
One master password opens all three, no client is a paid add-on, and every reveal reaches the same audit log. What each client does, and where each one is today →
For administrators
Control without custody
Administrators run the organisation and still cannot read a vault they were not given. That distinction is the product.
Countersign new members
Compare a short code over a separate channel, then countersign the member's key with the organisation signing key. Impersonation dies at this step.
Recovery you control
An administrator approves recovery with the organisation recovery key, generated in your browser at signup and never sent to us.
Revoke and rotate
Revoking access re-encrypts every entry under a new key, resumable if interrupted. The old key stops working, mathematically.
Append-only audit
Who opened which vault, revealed which entry, shared and revoked what, and when. The log can be appended to, never edited, not even by us.
Organisation MFA policy
Require a second factor before any reveal for members using email sign-in. Directory members follow the policy you already set in your IdP.
Billing that behaves
Active seats only, prorated, with payment handled by Stripe; card details never touch Keyvaci. A lapsed subscription means read-only, never data loss.
See it with your own tenant
Setup takes minutes, and with Entra ID or Google Workspace it touches nothing else in your directory. Rollout questions, another IdP, a larger team: we answer email quickly.