platform / credentials
The vault holds the password. Nobody else does.
Server, service and database passwords live in the vault and rotate on a schedule or after each use. People connect through the gateway and never see them.
dbadmin@prod-db-01
••••••••v42
Database · After each use
Connect via gatewayAdministrator@fs-02
••••••••v118
Windows local admin · Every 24 h
Connect via gatewaysvc_backup@backup-01
••••••••v19
Service account · Every 7 days
Connect via gateway
Demo tenant. Secrets are never displayed; versions are shown by number.
At a glance
Nobody keeps a password.
Passwords still exist. The vault holds them and changes them, so no person keeps one between sessions.
What it does
Holds server, service and database passwords, rotates them on a schedule or after each use, and issues SSH keys or short-lived certificates to the right people and servers.
What it replaces
Passwords in spreadsheets, authorized_keys files nobody can account for, and server accounts made by hand.
What you need
The gateway for servers. The DB agent for databases.
With just-in-time access and the gateway, that is what we mean by no standing access.
What the vault does
Passwords, SSH keys and server accounts, run by the vault
The vault takes over the password and key work admins do by hand today, and leaves no standing password behind.
Vault, no reveal
no revealPeople connect through the gateway. The password is never shown or copied.
Scheduled rotation
every 24 hPasswords change on the interval you set, and the previous one stops working.
Rotate after use
after each sessionWhen a session ends, the password it used is replaced before anyone can reuse it.
SSH key distribution
push · revokePush a key or a short-lived certificate to a server list, and revoke it from the same list in one step.
Server account lifecycle
create · deleteCreate a user on several hosts at once, and remove it from all of them when it’s done.
No standing passwords
result ✓Every server, service and database password sits in the vault and changes before anyone can reuse it.
How rotation works
Follow one password through a week.
Five moments in the life of a database password: a nightly rotation, an admin session, the rotation after it, a refused login and the week’s total. Step through them in order.
dbadmin@prod-db-01rotates nightly at 02:00 and after every session
Step 1 of 5Mon 02:00
The vault sets a new password every night.
At 02:00 the vault generates a new password for dbadmin and sets it on prod-db-01 through the gateway. Nobody is involved and nobody sees it.
- Working password
- v37
- Old password
- v36 stops working
- Seen by a person
- Nobody
Vault
holds the password
No one
not involved
Gateway
opens the session
prod-db-01
dbadmin
- Mon 02:00:00 scheduled rotation started
- Mon 02:00:03 dbadmin v36 → v37 · live
Demo data. Versions are numbered so you can follow them; the passwords themselves are never shown.
How it fits
Two components to install. The vault comes with AuthNull.
| Component | Install it on | Needed for |
|---|---|---|
| GatewayYou install | A Linux VM inside your network | Server passwords, SSH keys and server accounts |
| DB agentYou install | Next to each database | Database passwords |
| VaultPart of AuthNull | Nothing to install | Holds passwords, schedules, keys and accounts |
Only servers need the gateway, and only databases need the DB agent.
Compliance
The rotation log is the evidence.
- PCI DSS 4.08.3Strong authentication for users and administrators.Vault-held passwords and rotation history
- PCI DSS 4.08.6System and application account passwords are protected and changed periodically.Service account rotation log
- CMMCIA.L2-3.5.10Store and transmit only cryptographically protected passwords.Passwords held in the vault, never shown
- SOC 2CC6.1Logical access controls over protected information assets.Key and account inventory per server
AuthNull supports evidence collection for these controls. It does not certify compliance.
FAQ
FAQ
- No. Server, service and database passwords still exist. The vault holds and rotates them, so no person keeps one between sessions.
- People connect through the gateway, which signs in with the password for them. The password is not shown to them.
- On a schedule you set, or after each use.
- Both. The console issues SSH keys or short-lived certificates to the right users and servers, and revokes them from the same place.
- One action disables the user, revokes their keys and rotates every password they used.
- A sealed emergency account stays in the vault. Opening it raises an alert, and its password is rotated afterwards.
- The gateway for servers and the DB agent for databases.
Book a demo
In 20 minutes we’ll vault one of your server passwords, rotate it, and connect to the server through the gateway.
- You send the formTwo minutes: who you are and what you want to protect.
- We reply within a dayAn engineer emails you to pick a time.
- A live 20-minute demoShown against your setup, with time for questions.