Versioned KV secrets
A Vault-compatible KV v2 engine: versioned reads and writes, check-and-set, soft-delete and destroy, per-path metadata — every value sealed before it touches disk.
Open-source · multi-region · self-hostedSecrets, encrypted per tenant.
Secrets, encrypted per tenant.
Replicated across regions.
WSLVault is a self-hosted secrets manager built on envelope encryption and a per-tenant key hierarchy — with dynamic leases, transit encryption, PKI, a signed audit trail, and active/active replication between regions.
$ wslvault login --key wslv_… ✓ authenticated as tenant acme region=manchester $ wslvault kv put prod/db/creds password=s3cr3t ✓ sealed with dek 01a0…93a7 version=1 $ wslvault kv get prod/db/creds --region london # same secret, decrypted in the peer region password = s3cr3t replication_lag=14ms
One vault, every secret type
Everything a secret needs, behind one API
Static and dynamic secrets, encryption-as-a-service, a private CA, and the identity and policy layer to govern them — each engine sealed by the same per-tenant key hierarchy.
Envelope encryption
AES-256-GCM with a per-tenant key hierarchy. Data keys are wrapped under a tenant KEK, which is wrapped under a root key held only by the crypto service.
Transit engine
Encryption as a service: encrypt, decrypt, sign and verify without the plaintext key ever leaving the vault. Keys rotate while old ciphertext stays readable.
PKI & certificates
Issue and manage a private CA, roles and short-lived certificates. CA private keys are envelope-encrypted under their own root, never stored in the clear.
Dynamic leases
Every credential is a lease: issued, listed, renewed and revoked for real. Revoking a token stops it working immediately, not just flips a row.
Policies & identity
Fine-grained policies over API keys and JWTs, with MFA/TOTP, SCIM, LDAP, OIDC, mTLS and cloud-workload auth. Identity comes from a signed token, never a header.
Active / active by design
Two regions, one mesh
Each region is a complete, independent stack — its own database, its own services, its own public hostname. They share nothing at runtime but key material, and each region’s agent pulls the other’s changes over the public edge.
Region A
manchester · active
- Own PostgreSQL, node-local storage
- Full service set, sealed at rest
- Serves its own public endpoint
encrypted
replication
Region B
london · active
- Byte-identical key material
- Reads secrets written anywhere
- Fails over as a PoP-side change
Security model
Encrypted where it matters, provable after the fact
The vault fails closed. Keys are wrapped, custody can be split, and every action is signed into a chain you can verify.
Signed, tamper-evident audit
Every operation joins a per-tenant hash chain signed with a dedicated key — a record cannot be altered or removed without breaking the chain.
Shamir-split custody
The root key can be split into Shamir shares so no single operator can unseal the vault alone. It starts sealed and stays sealed until a quorum agrees.
Tenant isolation to the key layer
A data key belongs to exactly one tenant; a cross-tenant request returns “not found” rather than another tenant’s data. Isolation holds even at the crypto service.
Zero plaintext at rest
Secrets, transit keys and CA material are all encrypted before storage. A database dump yields ciphertext wrapped under keys the database never sees.
Built for your stack
Cloud-native, and scriptable everywhere
Ship it with the Helm chart and Kubernetes operator, drive it from GitOps, scrape it with Prometheus, and reach it from your language of choice — or from an AI agent over the built-in MCP server.
Rust servicesgRPC + HTTPPostgreSQLHelm chartKubernetes operatorGitOps / Argo CDPrometheus metricsMCP server
Official SDKs & CLI
GoPythonRustTypeScriptCLI
The same JSON contract across every client, generated from one set of protobuf definitions — so a secret read in Go looks like a secret read in TypeScript.
Self-hosted & open source
Stand up your own vault
Clone the repo, install the Helm chart, and unseal. The getting-started guide takes you from an empty cluster to your first sealed secret.