SecretsComing soon · Security Platform

Vault, KMS, PKI, SSH, and a Kubernetes Secrets Engine — one engine.

The secrets pillar covers static-secret storage, dynamic database credentials, encryption-as-a-service, an internal certificate authority, SSH key management, and a Kubernetes Secrets Engine with CSI driver, sidecar injector, External Secrets Operator plugin, and direct SDK. One engine, one audit log, one billing line.

Get a demoRead the docs
Secret vault with concentric encryption rings and ECDSA P-384 trust anchors.

What's in the box

Every secrets primitive you need, in one engine.

Tessarac Secrets is a direct competitor to HashiCorp Vault — same primitives, same backends, same operational shape — except it's part of the platform that already has your identity, audit log, and access control. Migrating off Vault is a backend swap, not a re-architecture.

  • Static secret storage with hierarchical paths, versioning, and TTL
  • Dynamic database credentials — Tessarac mints a fresh database user per request against every major relational and document store, revokes on TTL or session close
  • Encryption-as-a-service — encrypt/decrypt without ever holding the key in your app
  • Internal certificate authority — issue, rotate, and revoke X.509 certs for service identity
  • SSH key management with hardware-bound origin and just-in-time signing
  • BYOK / HYOK — bring any major cloud key-management system or HashiCorp Vault as the root key holder

Kubernetes-native — pick your integration shape

Four ways to consume secrets in Kubernetes. All four point at the same engine, same audit log, same RBAC.

  • Kubernetes secrets engine with CSI driver and sidecar paths.

    CSI Secrets Store driver

    Mount Tessarac secrets as files in your pod. Standard Kubernetes pattern, no app changes. Updates propagate via the CSI driver's standard refresh interval.

  • Secret vault with active rotation surfaces.

    Sidecar injector

    Annotation-driven sidecar that fetches secrets and writes them to a shared volume. Useful when you want secrets fetched at pod start, not at every read.

  • Concentric cordon rings showing graduated isolation.

    External Secrets Operator plugin

    If you already run External Secrets Operator, add Tessarac as a SecretStore provider. Your existing ExternalSecret manifests start resolving against Tessarac.

  • Role-based access control surface with policy gates.

    Direct SDK

    Idiomatic SDKs in Go, Python, Node, Java, .NET, Rust, Ruby, PHP — for apps that prefer to fetch secrets in-process. Hardware-bound workload identity validates the request before the secret leaves the engine.

Trust model

Every secret is encrypted with a key Tessarac doesn't hold.

With BYOK enabled, the AES-256-GCM data encryption key for every tenant is wrapped with the tenant's own root key (held in your own cloud KMS, HSM, or on-premises HSM). Tessarac stores only the wrapped form. Even our operators cannot decrypt your secrets — the key path goes through your own infrastructure.

  • Per-tenant ECDSA P-384 trust anchor — one tenant's compromise can never reach another tenant's key path
  • Envelope encryption end to end — agent payload, in-transit, at-rest, all wrapped
  • BYOK / HYOK options for every major cloud key-management system, HashiCorp Vault, or on-prem HSM
  • Air-gap key-ceremony patterns documented for sovereign deployments — never touches a public network
  • FIPS 140-3 validated cryptography enforced on the Federal plan; standard plan uses the same primitives unvalidated

Migrate off your secrets vendor in a sprint, not a quarter

Tessarac Secrets imports from HashiCorp Vault and every major cloud secrets manager. Your code stays the same.

Get a demoRead the docs