Lowp tae content
Leid: SCO
Menu

Secret management

Haven

Beta

It hauds ither seestems’ credentials, sae it fails closed.

Veisit Haven Documentation Contact us

A secret manager for the credentials that sit ahint a business: database passwords, API keys, signing keys and certificates. It issues thaim wi an expiry, scopes whit ilka application may reach, and records ilka request afore it runs. Its master key never touches disk, and efter a restart it stays lockit until eneuch o yer named haulders combine their shares tae open it, sae possession o the server is no possession o the secrets.

Wha it is for. Organisations that maun shaw whaur a credential cam frae, wha could uise it and whan it wis withdrawn, and that want credentials tae expire on their ain.

Status
Beta
Pairt o
Core platform
Product site
haven.rodmena.co.uk
Tags
Management o secretsCredentals that are expirinSplit-key unlockAudit trail

Whit it dis

  • Lockit till yer fowk open it

    The master key is niver written tae disk. Efter a restart, three o five share haulders maun combine their pairts afore onything can be read, sae a stown server or a copied backup gies up naething.

  • Separation atween teams

    Ilka tenant haes its ain encryption key, its ain policies an its ain secrets, an the mairch is enforced inside the database. A caller canna ask tae be treatit as anither tenant; that is fixed by the credential it presents.

  • Credential that expire on their ain

    A database password is issued per process wi a lifetime attached, creatit whan it is askit for an withdrawn whan the time is up, sae a leaked password stops wirkin withoot onybody noticin it leaked.

  • Applications haud na keys

    Haven encrypts and decrypts on their behalf, so the key never reaches the application. Rotating a key leaves everything already encrypted readable.

  • A private certificate authority

    Short-leeved certificates are issued per service, wi the domains a role may ask for constrained by that role.

  • An audit trail that is checked

    Ilka request is recordit afore it rins, an ilka record is chained tae the ane afore it by a hash. Verification walks the chain an recomputes it.

Documentation and access details are on the product site, haven.rodmena.co.uk. For a pilot, an integration or procurement questions, contact us.

Screens

All 6 screens of Haven