Security
How Vaultez protects your secrets
This page is written for the people who review tools before their company adopts them. It describes where your data lives, how it is protected, who can reach it, and what we do not offer yet. If you need anything that is not covered here, email support@vaultez.app.
Last updated: October 15, 2026
At a glance
| Data location | European Union: UpCloud data center in Helsinki, Finland |
|---|---|
| Backups | Automatic: daily (kept 7 days), weekly (4 weeks) and monthly (12 months) |
| Encryption at rest | Secret values, notes, audit change details and 2FA secrets are encrypted with AES-256-GCM before they are written to the database |
| In transit | HTTPS only, with HTTP Strict Transport Security |
| Sign-in | Two-factor authentication required for every user, on the web and in the CLI, with rate-limited login attempts |
| Access control | Per company, per project and per secret |
| Audit trail | Every time a secret value is viewed, copied or fetched is logged, along with every create, change and delete |
| Third parties | UpCloud (hosting), Stripe (payments), Proton Mail (email). No analytics or ad trackers |
| Breach notification | Affected customers are notified without undue delay |
1. Where your data is stored
Vaultez runs on a dedicated cloud server operated by UpCloud in their Helsinki, Finland data center. All application data, including your secrets, accounts, projects and audit history, is stored on that server inside the European Union. We do not replicate customer data to other regions or providers.
Backups. The server is backed up automatically by UpCloud: daily backups are kept for 7 days, weekly backups for 4 weeks and monthly backups for 12 months.
Payment card details never reach our servers. Payments are handled entirely by Stripe on Stripe-hosted pages, and we only store the identifiers Stripe gives us to link your subscription to your company.
2. Encryption
The following are encrypted at the application level with AES-256-GCM before they are written to the database, and decrypted only when an authorized user or token requests them:
Secret values.
Secret notes.
Audit trail change details, which can contain note text and previous secret names. Secret values are never written to the audit trail at all.
Two-factor authentication secrets.
The encryption keys are kept in the application's encrypted credentials, separate from the database, so a copy of the database alone does not reveal this data.
What is not encrypted at the application level: secret names, tags, project and company names, and account details such as names and email addresses. These are needed for search, sorting and sign-in. Treat secret names as visible metadata and keep sensitive material in the secret value or note.
In transit, every connection to vaultez.app, from the browser and from the CLI, uses HTTPS. Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only (HSTS). Certificates are issued and renewed automatically by Let's Encrypt.
3. Authentication
Two-factor authentication is mandatory. Every user must set up an authenticator app (TOTP) before they can use Vaultez, and the CLI requires a two-factor code at sign-in as well. One-time backup codes are provided for account recovery.
Rate limiting. Password and two-factor attempts are limited per IP address and per account, on the web and in the CLI, to stop guessing attacks. Password reset requests and sign-ups are limited as well.
Passwords are stored only as bcrypt hashes. Two-factor secrets are stored encrypted. Backup codes are stored only as SHA-256 hashes and each can be used once. Password reset links expire after two hours.
4. Access control
Company isolation. Every project and secret belongs to one company. Users only see data in companies they are members of.
Project roles. Within a company, users get access to individual projects as owner, admin or member. Owners and admins manage who belongs to a project.
Per-secret access. Access is granted per secret, so a project member does not automatically see every secret in that project. Access can be granted, changed and revoked at any time.
Removing people. Owners can remove a user from the company at any time. The user loses access to that company's projects and secrets immediately.
5. CLI and machine access
Personal CLI tokens are issued after a password and two-factor sign-in, and are revoked when you log out of the CLI.
Project tokens for CI/CD and servers are limited to a single project and can only read secrets, never change them. They are shown once at creation and can be revoked at any time by a project owner or admin.
Both kinds of token are stored only as SHA-256 hashes, so they cannot be read back from our database.
6. Audit trail
Vaultez records who did what and when for each secret.
Every access to a value. Secret values are never embedded in web pages; they stay hidden until a user clicks reveal or copy, and each of those is recorded. Every value fetched through the CLI is recorded, and so is every fetch with a project token, including the token's name.
Every change. Creation, changes to the name, value or note, and deletion.
Every access change. Access granted, revoked or changed to a different role.
The history is visible on each secret to users who can view it.
7. Our internal access
Production infrastructure is accessible only to authorized Vaultez personnel, over SSH with key-based authentication. Password logins to the server are not used.
Our internal admin tools show companies, users and subscription status. They do not display secret values.
8. Third parties (sub-processors)
UpCloud (Finland): hosting of the application and all customer data.
Stripe: subscription billing and payment processing.
Proton Mail (Switzerland): delivery of account emails such as invitations and password resets.
We do not use analytics, advertising or tracking services, and we never sell or share your data.
9. Data retention and deletion
Your data is kept for as long as your account is active. To close your account or your company's account, email support@vaultez.app from the address registered to the account. We delete the company together with all its projects, secrets and audit history within 30 days, unless we are required by law to retain it.
Copies may remain in our backups until those backups expire, at most 12 months later. Backups are only used to restore the service and are never used to recover data that a customer has deleted.
10. Incident response
If we identify a security incident affecting customer data, we contain it, investigate it, and notify affected customers without undue delay, including what happened, what data was involved and what we are doing about it. Where required, we also notify the relevant data protection authority under the GDPR.
11. What we do not offer yet
We would rather be clear than have you discover these during a review:
No third-party certifications such as SOC 2 or ISO 27001.
No single sign-on (SAML / OIDC).
Hosting in a single region (Finland); no choice of data region.
No customer-managed encryption keys.
If any of these are requirements for you, tell us. Customer needs decide what we build next.
12. Reporting a vulnerability
If you believe you have found a security issue in Vaultez, email support@vaultez.app with the details. Please give us reasonable time to fix it before disclosing it publicly. We will confirm receipt and keep you updated.