Vault for software & IT services

Client credentials that leave the chat thread and land in a vault the server cannot read

An IT services team holds the keys to other companies’ infrastructure: production database passwords, cloud console logins, registrar accounts, API keys for a dozen integrations. They end up in a channel because the alternative is one engineer’s personal password manager that nobody else can open when that engineer is on leave. Vault gives each client a collection, each engineer named access, and each read an audit entry.

Talk to us Everything Vault does

Included in every plan. No per-seat charge, no per-tool upsell.

In practice

What Vault does for software & IT services

A collection per client, folders per environment

Group credentials by client and, within a client, by staging, production and third-party services. Share the collection with the engineers on the account, or a single item with one person for a single incident.

Encrypted before it reaches us

Every item is encrypted in the browser with a key derived from the member’s passphrase. The server stores ciphertext only, so a compromise of Orbiz’s infrastructure yields nothing readable about your clients’ systems.

Escrow recovery when an engineer forgets their passphrase

A forgotten passphrase is not a lost client. Recovery runs through an escrow flow your organisation’s admins control, restoring the engineer’s access without anyone at Orbiz — or anyone in your company — reading the secrets.

An audit log that answers the client’s security questionnaire

Every read, share and change to a credential is recorded with who and when. When a client asks who has accessed their production password in the last quarter, the answer is a filter, not an investigation.

One platform

Where Vault hands off for a software team

Vault shares with the same members and roles as every other tool. When an engineer is marked inactive in HRMS their access to every shared item ends with it, which is the offboarding step most agencies discover they missed six months later. Rotating the credential is still your job; knowing exactly which ones they could read is not.

Software & IT · Vault

Questions software teams ask about Vault

Can we share a credential with a client’s own staff?

Sharing is with members of your organisation. A client engineer can be invited as a member with a narrow role and given access to the specific items they need, and their access ends the moment their membership does. Collections are never opened by public link; for one secret a client needs once, a Send seals that single field into a link that expires or burns after the first read.

Does Vault store SSH keys and certificates, or only passwords?

An item is a set of encrypted fields, so private keys, certificates, API tokens and recovery codes are stored the same way as a username and password. Anything you would paste into a terminal fits; it is encrypted in the browser before it is sent.

Is Vault a replacement for a secrets manager in our deployment pipeline?

No. Vault is for people: engineers reading and sharing credentials. It has no API for machines to fetch secrets at deploy time — and AI assistants connected through Orbiz MCP cannot reach it either, by design — so a pipeline secrets store such as your cloud provider’s stays where it is. Vault holds the credentials to that store.

Want Vault set up for your software team?

It comes with every plan, alongside the other tools. Tell us your team size and we set up a working organisation for you to try.