Project Vault
AGPL-3.0
Read the codeSecurity isn't a feature here. It's the architecture.
Here’s exactly how CentralizeMe protects your projects’ credentials — in enough detail to check our work.
CentralizeMe runs on Project Vault, an open-source, self-hostable project operations platform. The engine that stores and protects your secrets is public code — auditable by anyone, including you.
Open-core clarity: what’s open (the engine) vs. what’s CentralizeMe-specific (multi-tenant hosting, billing, tiering) — honest scoping of the auditability claim
Architecture
Pool / RLS
- Tenants
- RLS policy layer
- Shared database
Silo
- Tenant
- Dedicated infrastructure
Tenant isolation, plainly: shared infrastructure (Pool) with PostgreSQL Row-Level Security enforcing per-tenant visibility at the database layer — every query constrained by policy, not by application discipline alone. Dedicated infrastructure (Silo) available for Enterprise.
Encryption: at rest (secrets envelope-encrypted before storage) and in transit (TLS everywhere).
Boundaries we build to (our internal normative rules, now public commitments): secret values never enter search indexes; list payloads carry metadata only; values are fetched only at the moment of reveal, copy, or rotation
Access model: WorkOS-backed authentication; scoped roles per project; guest and link-based temporary access with automatic expiry
See how this works →Audit & operations
What the audit trail records: every reveal, copy, rotation, share, grant, and revocation — actor, action, target, timestamp. From day one, on every tier.
Temporary access mechanics: scope + duration set by the grantor; expiry is automatic; post-expiry rotation reminders close the loop
Rotation support: usage inventories and rotation checklists — because a rotation that breaks production is a rotation nobody performs
Compliance & roadmap
GDPR: data residency stated; right-to-erasure honored (account deletion removes tenant data); processors listed (WorkOS — authentication; Paddle — payments; AWS — data storage) with links to their compliance pages
CentralizeMe is designed for SOC 2 from day one — audit logging, access control, and isolation are architectural, not bolted on. Formal certification is on our roadmap and not yet complete. If your evaluation requires the report itself, tell us — it moves the roadmap.
Responsible disclosure: security@centralizeme.com, acknowledgment commitment, no-legal-threats-for-good-faith-research statement