Credential Vault

The Credential Vault is a built-in secrets manager for your Auris tenant. It stores passwords, API keys, SSH keys, certificates, database credentials, and other sensitive values under AES-256-GCM field-level encryption. Secrets never leave the server in plaintext — the vault decrypts a credential only when a user explicitly requests it through the Console or API, and every such access is recorded in the audit log.

Access the Vault from the Console sidebar: Vault.

Vault Lock and PIN

Every user in your tenant has their own vault session. The vault starts in a locked state. Before accessing any credentials, the user must unlock it with a numeric PIN.

Setting a PIN

Unlocking the Vault

When you navigate to any Vault page while locked, an unlock dialog appears. Enter your PIN and click Unlock. After five consecutive failed attempts within 15 minutes, the vault enforces a 15-minute lockout — you cannot attempt further unlocks until the lockout expires.

Locking the Vault

Click Lock Vault in the top bar at any time. The vault immediately requires the PIN again before any credential can be accessed or revealed. A PIN must be set before you can lock — calling lock without a PIN returns an error.

Changing the PIN

Go to Vault → Settings → Change PIN. You must supply the current PIN before setting a new one.

Credential Types

The Vault supports the following credential types. Each type stores a different set of secret fields, all encrypted in the same encryptedData blob.

In addition to secret fields, every credential has metadata fields that are stored unencrypted for display purposes: name, tags, notes summary, expiry date, and health status.

Creating and Managing Credentials

Creating a Credential

Editing a Credential

Open any credential from the list and click Edit. Metadata fields (name, tags, notes, expiry, folder) update immediately. Secret fields are only updated when you supply a new non-empty value — leaving a secret field blank during an edit preserves the existing encrypted value without overwriting it.

Revealing a Secret

Click Reveal on any credential to decrypt and display the secret fields. Reveal is rate-limited to 10 requests per minute per session. Every reveal is recorded in the audit log with the user, timestamp, and IP address.

Click Copy to copy the secret value to the clipboard without displaying it on screen. Copy actions are also audit-logged separately from reveals.

Health Status

The Vault continuously evaluates each credential and assigns one of the following health statuses:

The Overview dashboard shows the overall health score for your vault and a breakdown by issue type.

Folder Organization

Folders help organize credentials and define sharing boundaries. Folders can be nested to any depth.

Creating a Folder

Moving a Folder

From the folder list, open the folder menu and click Move. Select the target parent folder. Circular moves (moving a folder into one of its own descendants) are rejected.

Deleting a Folder

Deleting a folder cascades to all credentials inside it. A confirmation dialog lists the number of credentials that will be deleted. This action cannot be undone.

Sharing Folders

Folders can be shared with individual team members. Sharing grants access to all credentials currently in the folder and all future credentials added to it.

Permission Levels

Sharing a Folder

Updating or Revoking a Share

From the Shares tab on any folder, click the permission badge next to a recipient to change their access level, or click Revoke to remove their access entirely.

Device Binding

Device binding lets you associate vault access with specific trusted devices. This is used by the audit system to track which device performed a reveal or copy action, and by vault policies that require device trust before allowing secret access.

Registering a Device

Device Statuses

Revoking a Device

From Vault → Devices, click Revoke next to any device. Revoked devices cannot be associated with new reveal or copy operations.

Access Requests

When a user needs access to a credential or folder they do not currently have permission to, they can submit an access request.

Submitting a Request

From any credential or folder the user can see but not access, click Request Access. Select the permission level needed and provide a reason. The request is sent to the folder or credential owner for review.

Reviewing Requests (Admins)

Go to Vault → Access Requests. Each pending request shows:

• Who is requesting access
• Which credential or folder
• The permission level requested
• The reason provided
• When the request was submitted

Click Approve to grant the requested permission, or Deny to reject it. In both cases the requester is notified.

Vault Policies

Vault policies let an administrator configure security requirements that apply across all vault operations for the tenant.

Go to Vault → Settings → Policy to configure:

Audit Log

Every vault operation is recorded. Go to Vault → Audit Log to browse the history.

Logged Actions

Audit Entry Fields

Each entry records:

• Action — One of the actions above
• Resource — The name and ID of the affected credential or folder
• User — Who performed the action (name denormalized at time of action)
• Timestamp — Precise date and time
• IP Address — Source IP of the request
• Device — If a trusted device was associated with the action
• Risk Score — A 0–100 score computed from contextual signals

Filtering the Audit Log

Use the search bar and action filter to narrow down entries. The default view shows all actions for all users. Entries cannot be deleted or modified — the audit log is append-only.

Overview Dashboard

Go to Vault (the root page) for the vault overview:

• Total credentials — How many credentials are stored
• Total folders — Including shared and personal folders
• Shared folders — Folders with at least one active share
• Trusted devices — Count of devices in Trusted status
• Health score — Percentage of credentials in Strong health (0–100)
• Health breakdown — Count of Weak, Reused, Old, Expiring, and Compromised credentials
• Credentials by type — Distribution chart across all credential types
• Recent activity — The last 10 audit entries across all users in the tenant

Console Navigation

The Vault is organized into the following sections in the Console sidebar:

Related

• Vault API — REST API reference for programmatic vault access
• Security Settings — Tenant-wide security controls including brute-force protection and MFA
• Users & Roles — Manage the team members who can be granted vault folder shares