Granular RBAC, multi-party approval, SIEM integration, and cryptographic offboarding — running on an architecture that provably cannot read your credentials.
Most enterprise password managers claim zero-knowledge. HexVault is architecturally zero-knowledge — credential ciphertext is generated on the client before it reaches our servers. There is no server-side path to read vault contents, because the decryption key never leaves the device. We cannot be subpoenaed for data we don't hold.
Per-entry key derivation via Argon2id + HKDF means even if your organisation's vault database were exfiltrated, individual entries would require independent brute-force attacks. Shared team credentials use envelope encryption with per-member key wrapping — revoking a member's access is immediate and cryptographically complete.
Read the full security architecture →HexVault currently runs as a managed cloud service — Docker / Traefik / PostgreSQL on dedicated infrastructure, served via Cloudflare. Self-hosted and on-premise deployment is on the roadmap for organisations that require data residency or air-gapped operation.
HexVault is being used today but is not yet in public launch. Enterprise customers who come in during early access receive founding pricing locked in permanently. We work directly with early enterprise customers to prioritise the features they need.
There will be downtime as we build. We document everything in the changelog, maintain a live status page, and aim for transparent communication about what’s happening and when. If that’s acceptable for your use case right now, we’d like to talk.
We’re working directly with a small number of early enterprise customers. Get in touch with your use case and we’ll respond within one business day.
Talk to us →