Vaults and entries

Create vaults, organize entries with folders and tags, reveal secrets, attach files and restore earlier versions.

Vaults

A vault is a container with its own encryption key and its own member list. There are two kinds:

Shared vaults, created by a Super Admin under Vault administration, or by users allowed to create vaults with New vault on the My vaults page.
Personal work vaults: every user gets exactly one, provisioned automatically. It is organization-managed, not private: it is subject to retention, offboarding and emergency access, and the server operator can access it like any other vault.

My vaults lists only the vaults you have been granted, with their type and your effective access. Favorite vaults appear directly in the sidebar.

Vault states

State	Meaning
Active	Normal use.
Read-only	Frozen for a review or hand-over. Entries, folders, tags and access cannot be changed; renaming and custody transfer still work.
Archived	Retired but kept. No changes until it is reactivated.
Pending purge	Marked for permanent removal. Nobody can access it. A Super Admin can restore it until the waiting period ends; then it is deleted automatically.

Read-only and archived vaults stay readable: people with access can still open entries and reveal values. The Custodian changes the state on the Vault governance page.

Entry types

Type	Fields
Login	Title, username, password, full URL, notes, optional authenticator seed
Secure note	Title and note text
SSH key	Public key, private key, passphrase, notes
TOTP	Issuer, account, secret, algorithm, digits, period, notes

Every entry can also carry custom fields, tags, an owner, an optional expiry date and file attachments.

What stays readable for search and lists: the title, the type, the sanitized host (for example github.com), folder, tags, owner and dates. Usernames, passwords, full URLs, notes, keys, seeds and custom values are encrypted and never searchable.

Creating and editing entries

Managers and Editors create entries with New entry. The form includes a password generator and a strength meter that run in your browser.

Saving is protected against lost updates: if someone else saved the entry after you opened it, Vaultigen reports a conflict instead of overwriting the newer version.

Revealing and copying

Open an entry and reveal or copy each value separately. Every reveal is a fresh request that re-checks your permission and writes an audit record before the value is returned. Revealed values are cleared from the page after 30 seconds.

Vaultigen records that the server delivered a value. It cannot know or control what your operating system’s clipboard does with it.

Folders

Managers create and rename folders. A folder can only be deleted when it is empty; Vaultigen never deletes a folder together with its contents.

File attachments

Files are encrypted with their own key before they are stored, under a random name outside the web root. The original filename is encrypted too.

Default limits: 25 MB per file and 500 MB per vault (configurable with VAULTIGEN_ATTACHMENT_MAX_BYTES and VAULTIGEN_VAULT_ATTACHMENT_MAX_BYTES).
Attachments are download-only. Vaultigen does not render previews of untrusted files next to your secrets.

Revisions and trash

Every change keeps the previous encrypted version as a revision. Managers can restore an earlier revision; the replaced state is kept in history too. If you may not place entries in the revision’s folder, the content is restored and the entry stays where it is.
Deleting an entry moves it to the vault’s Trash. Managers restore it from there until its purge deadline (default 30 days). See Deletion and retention.

Granting access

Managers open Vault members to grant Viewer, Editor or Manager to a user or team, optionally with an expiry. Folder and entry grants are added in the same way on the folder or entry. Expired and revoked grants stop working on the next request. See Roles and permissions.