HashiCorp Vault

Vault is a secrets management tool built for teams that need tight control over who can access sensitive data and when. It handles tokens, passwords, API keys, certificates, and encryption keys across applications, infrastructure, and services. Access is controlled through policies, and every interaction is logged, giving security teams full visibility.

The core use cases break down into a few distinct areas:

• Key/Value secrets engine: A straightforward store for persisting arbitrary secrets in Vault's configured backend storage.
• Database credentials: Rather than storing static database passwords, Vault generates short-lived credentials on demand based on pre-configured roles. Credentials expire automatically, reducing the blast radius of a breach.
• Encryption as a service: The Transit secrets engine encrypts data in transit without storing it, so your application can offload encryption without managing keys directly.
• Data tokenization: An enterprise feature that replaces sensitive values with cryptographically secure tokens, useful for protecting things like payment card data.

Vault fits teams running complex infrastructure who need more than a basic secrets management solution. It integrates with cloud providers, Kubernetes, databases, and identity systems, and supports a zero-trust architecture where no service is implicitly trusted.