Vault

Vault is a per-tenant secrets locker. Items — credentials, license keys, sensitive contract clauses — are encrypted client-side with the tenant master key (rotated annually, see Operations runbook) before reaching the api; the database stores only ciphertext. Access is permission-gated and audit-logged: every read records the staff member, IP, and timestamp. Items can be sealed (revealing the value requires a re-auth step) or unsealed (visible inline to anyone with read permission).

For platform secrets (DB credentials, API keys for payment gateways), use the platform-level secrets manager instead — the Vault is meant for tenant-owned, tenant-visible data.

Related endpoints

• GET /api/tenant/vault/items — list (returns metadata only, not values).
• POST /api/tenant/vault/items — create (server expects already-encrypted ciphertext).
• POST /api/tenant/vault/items/:id/reveal — produce a short-lived decryption token.
• GET /api/tenant/vault/items/:id/audit — access history.

See the source at apps/web/src/app/(tenant)/vault and apps/api/src/vault. Encryption helpers live in packages/crypto.