Client-side encryption
Items are encrypted in your browser with keys derived from your passphrase. The server stores ciphertext only and cannot decrypt what you save.
Vault · Secrets & credentials
A shared password manager for agencies and small teams that the server cannot read
Store client logins, API keys and shared accounts in collections, share single items with named teammates, and recover a lost passphrase through escrow — with encryption done in your browser, so we only ever hold ciphertext.
Included in every plan. No per-seat charge, no per-tool upsell.
What you can do
What Vault does
Share credentials with the people who need them, encrypted before they ever leave the browser.
Collections, folders and item sharing
Save logins, cards, identities and secure notes. Group them into collections and folders for a team or a client, or share an individual item with named teammates without exposing the rest.
Sends for one-off secrets
Seal a single field — a password, a card number, a note — into a link for someone outside the vault. Choose 1 hour, 24 hours, 7 days or 30 days, make it burn after the first read, and revoke it whenever you like. The key that opens it travels in the link itself and is never stored on the server.
Escrow-based recovery
A forgotten passphrase is not a lost vault. Recovery goes through an escrow flow that organisation admins control, so access is restored without weakening the encryption.
Full audit log
Every read, share and change is recorded with who and when, ready for the question a security review will ask.
Who it's for
Teams that get the most from Vault
- Agencies holding client credentials
- Collections per client, shared with exactly the people on the account.
- Security-conscious admins
- Zero-knowledge storage plus an audit log of every read and change.
- Teams tired of passwords in chat
- One place to share a login, with access that ends when the role does.
AI assistants
Vault is kept away from AI assistants
Vault has no assistant actions at all, by design. Credentials are encrypted in your browser, and no connected assistant can list, read or change them.
One platform
Vault is one tool of 10, not a silo
Vault shares with members of your organisation using the same identities and roles as every other tool. When someone leaves and their account is disabled, their access to shared items ends with it.
- HRMS — People & hiringRun hiring and people operations end to end — from a branded careers page to a signed employee record.
- Filespace — Files & storageA shared drive that belongs to your organisation, with quotas you control instead of licences you buy.
- Grabr — Screen recording & screenshotsRecord your screen with webcam and mic, capture and annotate screenshots, share a link instantly and see who watched.
Vault FAQ
Questions about Vault
Can Orbiz staff see our passwords?
What if someone forgets their passphrase?
Can I send a password to someone who is not on Orbiz?
Is there an audit trail?
Can an AI assistant read what is in Vault?
HRMS
AMS
Filespace
Cadence
Huddl
Grabr
Trackline
Notely
LedgrAlternatives and comparisons
From the blog
Related reading
SecurityGuidesZero-knowledge password manager recovery explained
Zero-knowledge means the vendor cannot reset a forgotten passphrase. Recovery codes, emergency access and admin escrow compared, and how Orbiz Vault recovers.
Zain Khalid Malik · · 9 min read
AI assistantsSecurityWhat AI assistants should never see in your company
Before you connect Claude or ChatGPT to HR, payroll and project data, decide what it may see. Six rules for safe assistant access, and how Orbiz applies them.
Zain Khalid Malik · · 4 min read
SecurityGuidesHow to share team passwords safely (zero-knowledge vaults)
Shared logins are unavoidable for small teams. How to share them without a spreadsheet: zero-knowledge, escrow recovery, and what an audit log must record.
Zain Khalid Malik · · 4 min read
Want Vault for your team?
It comes with every plan, alongside the other tools. Tell us your team size and we set up a working organisation for you to try.