How Vaultiqo protects your team’s secrets
A password manager is only as trustworthy as its design. Here is exactly how Vaultiqo encrypts, stores and audits your data, including the trade-offs we made and why.
- AES-256-GCMencryption in the browser, before anything is sent
- 2×encryption layers: in the browser and again on the server
- 1:1a separate encryption key for every organization
- 100 %of secret reveals recorded in the audit log
What happens when you save a secret
Four steps, from your keyboard to encrypted storage. Secrets are encrypted before they leave your browser.
01
Encrypted in your browser
Passwords, notes and details are encrypted on your device with AES-256-GCM through the browser’s built-in Web Crypto API, using your organization’s Tenant Key.
02
Sent over TLS
Only the encrypted blob travels to our servers, always over TLS. The server never receives a plaintext secret over the wire.
03
Encrypted again on the server
The server wraps the ciphertext in a second layer with a master key held in Google Secret Manager. A stolen database alone reveals only unreadable data.
04
Stored where you choose
The double-encrypted data lands in our hosted database, in your own Google Drive or in your own Firestore project. Attachments follow the same rule.
Our design, stated plainly
Vaultiqo uses managed encryption keys. Each organization has its own Tenant Key, stored encrypted under a server master key. When you sign in with Google, the key is delivered to your browser over TLS and kept only in memory, never on disk or in cookies.
This is a deliberate choice. It is what makes Google sign-in, shared team vaults and admin recovery possible without anyone having to remember a master password. The trade-off is that the team vault is not zero-knowledge: our servers are a trusted part of the system, so we protect them accordingly.
Who sees what
- People with access to the itemReadable password
- The network between you and usCiphertext inside TLS
- Google Drive and FirestoreCiphertext only
- A stolen database copyPasswords as ciphertext only
- Vaultiqo serversManaged keys, access locked down
- A public link on our serverCiphertext, no key
What this design protects against
- A copy of the database without the master key: it contains only ciphertext.
- Lost or forgotten master passwords: there are none to lose.
- Former employees: access ends with their Google account and a one-step offboarding.
Where the trust boundary is
The server master key is the crown jewel. It lives in Google Secret Manager behind tightly scoped access, supports zero-downtime rotation, and is never stored in the code or the database. Links you share with people outside the team are different: they are fully zero-knowledge, and their key never reaches our servers.
Access follows your Google Workspace
No separate accounts, no extra passwords. Access is granted, limited and revoked the same way you already manage your team.
Sign in with Google
Everyone uses their existing Google Workspace account, including whatever 2-step verification your organization enforces.
Short-lived sessions
Access tokens last 15 minutes. Refresh tokens rotate on every use, and replaying an old one ends the whole session family. Logging out revokes the session on the server.
Google security signals
When Google reports that an account was hijacked, reset or disabled, Vaultiqo ends that person’s sessions immediately instead of waiting for them to expire.
Strict tenant isolation
Every user is explicitly bound to one organization, and every read, edit, share and export is checked against it. Personal items stay private, even from admins.
Groups and roles
Owner, Manager and Member roles map directly to Google Groups. An admin runs the sync and sees a preview of changes before confirming.
Temporary access and offboarding
Grant access to a group for a fixed number of days and it expires on its own. When someone leaves, one step hands over their items and revokes everything.
Know who did what, and undo mistakes
Security is not only about keeping attackers out. It is also about seeing what happens inside and recovering when something goes wrong.
Audit log of every use
Vaultiqo records who changed a credential and also who used one. Each reveal is logged, extension autofill is tracked separately, and the log can be filtered by person or action.
Security Check in the browser
A one-click scan flags weak, reused, old and breached passwords. Breach checks use Have I Been Pwned with k-anonymity, so neither the password nor its full hash ever leaves your device.
Trash and version history
Deleted items wait 30 days in the trash, every edit keeps the previous version, and your data can be exported to CSV at any time.
Built defensively, end to end
The details that rarely make it onto a pricing page, but matter when you hand over your secrets.
- Runs on Google Cloud, with keys kept in Google Secret Manager
- Zero-downtime rotation of the encryption keys
- Restrictive Content Security Policy and strict security headers
- Rate limiting on sign-in and key endpoints
- SSRF protection, request size limits and per-workspace storage quotas
- Google OAuth tokens used for directory sync are encrypted at rest
- Browser extension that never stores secrets or tokens on your device
- Automated regression tests for tenant isolation and authorization
Security FAQ
Secrets are encrypted in your browser and again on our servers, and the keys are held in Google Secret Manager with tightly restricted access. Because the team vault uses managed keys rather than a zero-knowledge design, decrypting data is technically possible for the service itself, which is why that access is locked down and why the master key never sits in the database or the code. Public share links are fully zero-knowledge.
They only get passwords, notes and other sensitive fields as double-encrypted data. The second layer uses a master key that is not stored in the database, so a copy on its own cannot be read. Item names, usernames and website URLs are not encrypted.
Wherever you choose: in our hosted database on Google Cloud, in your own Google Drive, or in your own Google Firestore project with the location you pick. File attachments always follow the same choice.
Because there is no master password, nothing is lost with it. When Google suspends an account or reports it as compromised, Vaultiqo ends its sessions straight away. Once the account is restored in Google Workspace, a Vaultiqo admin restores access.
Write to hello@vaultiqo.app with the details. We take every report seriously and will get back to you quickly.
See it for yourself
Install Vaultiqo from the Google Workspace Marketplace and try it with your team. 14 days free, no credit card required.