Managing Secrets
This guide covers creating, viewing, editing, organizing, and deleting secrets in the concorbit Vault.
Creating a Secret
Open the Vault from the main navigation.
Select a folder in the left sidebar where you want to store the new secret. If you need a new folder, see Organizing with Folders below.
Click the New Secret button in the toolbar.
Fill in the secret form:
| Field | Required | Description |
|---|---|---|
| Name | Yes | A descriptive label for this secret (e.g., "Production Database", "Stripe API Key"). |
| Type | Yes | Choose from: Password, API Key, Secure Note, Payment Card, SSH Key, Certificate, Server, or Custom. |
| Value | Yes | The secret value itself (password, key, note content, etc.). This will be encrypted. |
| Username | No | An associated username or login ID. Stored encrypted; searchable via blind index. |
| URL | No | The website or service URL associated with this credential. |
| Notes | No | Additional encrypted notes (e.g., security questions, recovery codes, setup instructions). |
| TOTP Seed | No | A TOTP secret key for generating time-based one-time passwords. Stored encrypted. |
| Rotation reminder | No | How often the secret should be rotated, chosen from a fixed set of intervals: every 30, 60, 90, or 180 days, or every year. When the interval elapses, the secret will be flagged as due for rotation. Leave it on "No reminder" to disable. |
Click Save to create the secret.
The secret is encrypted immediately upon saving. The plaintext value is not stored anywhere, only the AES-256-GCM ciphertext is persisted to the database.
Secret Types
Choosing the correct type helps with organization and determines the icon displayed in the secrets list:
Password: Best for website and application login credentials. Pair with a username and URL for quick reference.
API Key: Use for API tokens, client secrets, signing keys, and webhook secrets. The URL field is useful for documenting the API endpoint.
Secure Note: Free-form encrypted text. Use the value field for the note body. Good for storing recovery codes, license keys, or any sensitive text.
Payment Card: Store card numbers, expiry dates, and CVVs. Use the notes field for billing address details.
SSH Key: Store private keys. Paste the full key content into the value field. Use notes for the associated public key or fingerprint.
Certificate: Store TLS/SSL certificates and private keys. Use the value field for the private key and notes for the certificate chain.
Server: Store server access credentials. Use the URL field for the hostname/IP, the username field for the login user, and the value field for the password or key.
Custom: A general-purpose type for anything that does not fit the categories above.
Revealing a Secret
Secret values are never loaded with the page. To view a secret's decrypted value:
Click on the secret in the secrets list.
Click the Reveal button (it toggles to Hide while the value is shown).
The system decrypts the value on the server and returns it via a secure JSON response.
The decrypted value, username, notes, and TOTP seed (if present) are displayed.
Each reveal is logged in the vault audit trail, recording who revealed the secret, when, and from which IP address. The secret's access count and last-accessed timestamp are also updated.
Copying to Clipboard
When a secret is revealed, each field (value, username, notes, TOTP seed) has a Copy button next to it. Click it to copy the field's content to your clipboard. A brief "Copied!" confirmation appears to confirm the action.
The copied value is placed on your system clipboard and is not stored or transmitted elsewhere by concorbit.
TOTP Codes
If a secret has a TOTP seed stored, concorbit can display it alongside the revealed secret. You can copy the seed to use in an authenticator app, or use it for reference when setting up two-factor authentication.
Searching Secrets
The Vault provides two search mechanisms:
Name Search
Use the search bar at the top of the Vault page. Type at least 2 characters to search secrets by name. Results show the secret name, type, folder name, and URL. Click a result to navigate to that secret's folder.
Name search is a case-insensitive partial match, searching for "prod" will find "Production DB", "Prod API Key", etc.
Username Blind Index Search
The Vault supports searching by username using a blind index. This means usernames can be searched without ever storing them in plaintext. When you search by username, concorbit computes the blind index of your search term and matches it against stored username hashes.
This search is exact-match only (unlike the fuzzy name search). The username you type must match the stored username exactly.
Editing a Secret
Navigate to the secret in the Vault.
Click the Edit button.
Modify any of the fields:
Name: Update the display name.
Type: Change the secret type.
Value: Enter a new value. Leave blank to keep the existing encrypted value unchanged.
Username: Update or clear the associated username.
URL: Update or clear the URL.
Notes: Update or clear the encrypted notes.
TOTP Seed: Update or clear the TOTP seed.
Folder: Move the secret to a different folder.
Click Save to apply changes.
When you update the value, it is re-encrypted with a fresh AES-256-GCM ciphertext. If you leave the value field empty during an edit, the existing encrypted value is preserved.
Rotation Reminders
Secrets can be configured with a rotation interval (in days). This is a reminder system. concorbit does not automatically change passwords, but it flags secrets that are due for rotation.
Setting a Rotation Interval
When creating or editing a secret, choose a value from the Rotation reminder dropdown. The available intervals are every 30, 60, 90, or 180 days, or every year. For example, selecting "Every 90 days" means the secret should be rotated every 90 days. Choose "No reminder" to turn the reminder off.
How Rotation Status is Calculated
The rotation countdown starts from the last rotated date, or the creation date if the secret has never been rotated.
When the interval has elapsed, the secret appears in the list with a rotation-due indicator.
The secrets list shows the number of days until rotation is due (or that it is overdue).
Rotating a Secret
When a secret is due for rotation:
Change the credential at its source (the website, API, server, etc.).
Edit the secret in the Vault and enter the new value.
The last-rotated timestamp updates, resetting the countdown.
Organizing with Folders
Creating a Folder
In the Vault sidebar, click the New Folder button (or right-click for a context menu option).
Enter a folder name.
Select an access tier (Staff, Management, or Director). This controls which team members can see the folder.
Optionally select a parent folder to nest the new folder inside an existing one.
Click Create.
Nested Folders
Folders can contain subfolders to any depth. Child folders inherit the scope of their parent:
A subfolder under a personal folder is automatically personal.
A subfolder under a tenant folder is automatically a tenant folder.
You cannot nest a personal folder under a tenant folder or vice versa.
Renaming a Folder
Select the folder in the sidebar.
Click the edit/rename action.
Enter the new name.
Click Save.
Changing a Folder's Access Tier
Select the folder.
Click the edit action.
Change the access tier to Staff, Management, or Director.
Click Save.
Note: Changing the access tier affects who can see the folder and all secrets within it. Users below the new tier will immediately lose visibility.
Deleting a Folder
Select the folder in the sidebar.
Click the Delete action.
Confirm the deletion.
Deleting a folder permanently removes the folder, all of its secrets, and all nested subfolders and their secrets. This action cannot be undone.
Deleting a Secret
Navigate to the secret.
Click the Delete button.
Confirm the deletion.
Deleted secrets are soft-deleted (moved to trash) and can potentially be recovered by an administrator within a retention window. After the retention period, they are permanently purged.
Personal Vault vs. Tenant Vault
The Vault page has two tabs:
Tenant Vault
Shared across the team.
Folders are subject to access tier restrictions.
Visible to all team members at or above the folder's required tier.
Use this for team credentials, shared service accounts, and client passwords.
Personal Vault
Private to you.
No access tier restrictions (only you can see your personal folders).
Other team members, including administrators, cannot browse your personal vault.
Use this for individual credentials that do not need to be shared.
To switch between the two, click the Tenant or Personal tab at the top of the Vault page.
Company Vault
Each company record in the CRM has a dedicated vault section accessible from the company detail page. Company vault folders:
Are scoped to the specific company.
Follow the same access tier rules as tenant folders.
Provide a convenient way to keep client credentials alongside client account information.
Can be shared with the client's portal contacts (see Vault in Client Portal).