Passwords, keys, notes — encrypted by the same architecture.
Encrypted secret storage for the credentials your team uses every day. AES-256-GCM with UMK wrap, distributed across the multi-cloud RAID topology. Available on every tier — including Free.
The secret store with no central honey-pot.
Password storage
Site, username, password, plus arbitrary fields. Generator built in. Categories and folders. Per-entry sharing scoped to teams within the account.
API key storage
Long-lived API tokens with provider tags, expiry tracking, rotation reminders. The credentials your CI pipeline rotates — without storing them in CI environment variables.
Encrypted notes
Free-form encrypted notes with markdown support. Useful for security playbooks, recovery procedures, and the documentation that absolutely should not live in plaintext.
Browser autofill
Extension for Chrome, Edge, Firefox, Safari. The autofill UX expected from a modern password manager, with the cryptographic posture expected from sovereign architecture.
Sharing workflows
Share an entry with a teammate, a team, or the whole company. Sharing rotates the per-entry DEK and re-wraps for the new recipient set. Revocation rotates again.
Free tier inclusive
SkyeVault is included on every tier, including Free. There is no honest world in which secret storage is a paid upsell — so it isn't one.
Why a password manager from a sovereign-storage company
Most password managers face the same architectural problem at scale: a central honey-pot of encrypted vaults. The vendor doesn't hold the keys, but the vendor holds the ciphertext — and the ciphertext is a target. The 2022 LastPass incident demonstrated what happens when that target is realised.
SkyeVault inverts the architecture. Each vault entry is encrypted client-side and stored as an object in the SkyeConnex multi-cloud RAID substrate. There is no central vault to breach — the encrypted entries scatter across seven providers in your residency policy. Compromising one or two providers reveals nothing. Compromising five providers simultaneously across multiple jurisdictions is the topology problem that secures the rest of SkyeConnex.
The cryptographic model
Each vault entry receives a per-entry data-encryption key. The DEK encrypts the entry payload (typically < 4 KB) using AES-256-GCM. The DEK itself is wrapped by the User Master Key — the same UMK that protects files in the main store. The UMK is derived from the user's password via scrypt and never leaves the device in unwrapped form.
For shared entries, the DEK is re-wrapped for each recipient's public key (the user's UMK has both a symmetric and asymmetric component). Revoking a share rotates the DEK and re-wraps for the remaining set. The recipient lifecycle is cryptographic, not access-list-based.
Browser, mobile, desktop — same vault
SkyeVault surfaces in three places:
- Browser extension — Chrome, Edge, Firefox, Safari. Autofill, generator, save-on-submit.
- Mobile — the SkyeConnex Flutter app. Biometric unlock, share-extension for native iOS/Android sharing.
- Web app — the SkyeConnex web app surfaces SkyeVault alongside files. Click an entry, copy a field, generate a strong password.
All three surfaces share the same underlying vault. The vault state syncs through the encrypted-and-scattered substrate, so a change on the laptop is available on the phone within seconds — without either device touching plaintext on the platform side.
Why it's on the Free tier
A team that hasn't bought your storage product can still benefit from sovereign secret storage. Making it a Free tier inclusion is partly an acquisition channel and partly an editorial position: there is no honest reason to gate password storage behind a paywall.
Encrypt the keys to your business.
Create a free account, install the extension, start importing. The vault is yours from minute one.