Approve from your phone's browser. No app installation required.
Where do you keep your secrets?
A hosting dashboard. A .env file. Your CI settings. Secrets tend to stay wherever you first needed them.
Wherever they are today
DATABASE_URL=●●●●●●
STRIPE_SECRET_KEY=●●●●●●
JWT_SECRET=●●●●●●
SENDGRID_API_KEY=●●●●●●
AWS_SECRET_ACCESS_KEY=●●●●●●
REDIS_URL=●●●●●●
OPENAI_API_KEY=●●●●●●
S3_BUCKET_KEY=●●●●●●
+ 6 more
After
NODVAULT_CLIENT_ID
NODVAULT_CLIENT_SECRET
The credential can request your secrets. It cannot release them without your approval.
No secrets left to stealAccess to your hosting can also mean access to your database passwords, API keys and other secrets.
What changes
It boots on your nod.
1 · in your build
Add one line
$ nodvault run --app shop-api \
-- npm start
2 · on your phone
Approve the request
Your service waits. Your phone asks whether you started it, and from where.
3 · on your server
It boots
nodvault: 14 secrets released
shop-api running
Your service reads them from its environment exactly as before. No SDK, no code changes.
What it costs
One flat fee. Priced by approvers. Everything else unlimited.
Solo
€19/month
or €190 a year
One approver. One person, any number of devices.
Team
€59/month
or €590 a year
Up to five approvers.
Sixth approver onward
€12/month
or €120 a year
Each, on Team. No ceiling.
Pay annually and get two months free, including extra approvers.
Approvers are people, not devices. One person using a phone and a computer counts as one approver.
Not metered
Apps, secrets, approvals, devices and client credentials.
Administrators are free
Only people who can approve releases count towards your plan. Administrators are free.
No sales call
All prices are published here. No sales call required.
And the part that is not money
Every fresh start needs your approval.
A restart at 03:00 waits until someone answers. If your service cannot wait, NodVault is the wrong tool.
On Solo, only you can approve a release. If you are unavailable, new starts wait. Need another person to approve? Upgrade to Team. The change takes effect immediately.
Why believe us
Stolen, it opens nothing.
We store your secrets encrypted. We hold no key that can read them.
Your hosting
A notification on your phoneThis key starts nothing on its own.
Our database
CiphertextLocked to keys only your devices hold. We hold none.
Our backups
CiphertextThe same: no key is in any backup of ours.
You can leave whenever you choose. Export your secrets and decrypt them offline with your recovery kit, even if your subscription is suspended.
What happens if a payment fails →
Not for everyone.
Not for services carrying open financial exposure, safety-critical work, or an availability commitment you have promised someone else.
Serverless, where there is no long-lived process to wrap.