Protect your secrets.

One line in your build. One nod on your phone.

Keep secrets out of your hosting environment. When your backend, API, worker or script starts, NodVault waits for your approval before releasing them.

Not open for signups yet. Write to us and we will tell you when it is.

Create an account Read the specification Tell me when it opens →

Approve from your phone's browser. No app installation required.

Where do you keep your secrets?

A hosting dashboard. A .env file. Your CI settings. Secrets tend to stay wherever you first needed them.

Wherever they are today

DATABASE_URL=●●●●●●

STRIPE_SECRET_KEY=●●●●●●

JWT_SECRET=●●●●●●

SENDGRID_API_KEY=●●●●●●

AWS_SECRET_ACCESS_KEY=●●●●●●

REDIS_URL=●●●●●●

OPENAI_API_KEY=●●●●●●

S3_BUCKET_KEY=●●●●●●

+ 6 more

After

NODVAULT_CLIENT_ID

NODVAULT_CLIENT_SECRET

The credential can request your secrets. It cannot release them without your approval.

No secrets left to stealAccess to your hosting can also mean access to your database passwords, API keys and other secrets.

What changes

It boots on your nod.

1 · in your build

Add one line

$ nodvault run --app shop-api \ -- npm start

2 · on your phone

Approve the request

Your service waits. Your phone asks whether you started it, and from where.

3 · on your server

It boots

nodvault: 14 secrets released shop-api running

Your service reads them from its environment exactly as before. No SDK, no code changes.

What it costs

One flat fee. Priced by approvers. Everything else unmetered.

Solo

€19/month

One approver.

Team

€59/month

Up to five approvers.

Sixth approver onward

€12/month

Each, on Team.

Approvers are people, not devices. One person using a phone and a computer counts as one approver.

All of it, including what is not metered →

And the part that is not money

Every fresh start needs your approval.

A restart at 03:00 waits until someone answers. If your service cannot wait, NodVault is the wrong tool.

On Solo, only you can approve a release. If you are unavailable, new starts wait. Need another person to approve? Upgrade to Team. The change takes effect immediately.

Why believe us

Stolen, it opens nothing.

We store your secrets encrypted. We hold no key that can read them.

Your hosting

A notification on your phoneThis key starts nothing on its own.

Our database

CiphertextLocked to keys only your devices hold. We hold none.

Our backups

CiphertextThe same: no key is in any backup of ours.

You can leave whenever you choose. Export your secrets and decrypt them offline with your recovery kit, even if your subscription is suspended. What happens if a payment fails →

Not for everyone.

Not for services carrying open financial exposure, safety-critical work, or an availability commitment you have promised someone else.
Serverless, where there is no long-lived process to wrap.