The vault is in your name
It is opened in your name, on your server or with a host in Europe. You are its administrator, and if you switch providers, the vault and everything in it remain yours.
AI vault
AI vault: your keys stay yours, your AI uses them without seeing them
Your passwords and access keys leave emails, chat threads and stray files for a vault opened in your name. Nobody else reads anything in it, neither us nor your AI, and yet your automations and your agents use it every day.
The market in figures
What public statistics, research and industry studies measure. Each figure links to its source, and when the author sells consulting or AI, we say so.
57%
of French employees surveyed hide their use of AI at work and present what it produces as their own work.
Source: KPMG, 2025 global study on trust in AI, with the University of Melbourne, 30 April 2025
More than 48,000 people in 47 countries, surveyed from November 2024 to January 2025; French sample size not published. KPMG sells audit, consulting and AI services.
31%
of UK workers who use generative AI at work do so without their employer’s knowledge, and 17% pay for at least one tool themselves.
Source: Deloitte, GenAI Workforce Survey, 16 September 2026
25,000 UK workers aged 18 to 70, surveyed by Ipsos from 7 May to 10 June 2026. Deloitte sells consulting, audit and AI services.
72%
of the large companies surveyed report AI security risks they do not control.
Source: BCG, “The Widening AI Value Gap”, 30 September 2025
1,250 executives in 68 countries, 90% at companies with over $1 billion in revenue; fieldwork dates not published. BCG sells AI consulting.
What you gain
Even we have no access
At handover, our access is removed and every key we may have come across during the project is changed. Need us later? You open a time-limited access, recorded in the log.
Your AI uses keys without seeing them
An agent asks for an action, and the key is added at the moment the request leaves, only towards the intended service. The model never reads it: it can neither repeat it nor send it elsewhere, even when tricked by a hidden instruction.
Everyone sees only what concerns them
One identity per person, per automation and per agent, with only the rights it needs. A contractor leaves, a key leaks: you cut that access without breaking anything else.
A key changed once, up to date everywhere
The vault feeds your tools, your hosting and your publishing pipelines. Changing a key no longer means hunting down its copies in ten files.
A log that answers in minutes
Who used which key, when, and from which tool or agent: everything is recorded. The day a doubt arises, you have an answer rather than an investigation.
Who it is for
- Your passwords and API keys travel by email, by chat or in a shared spreadsheet.
- You connect AI agents or automations to your tools, and nobody knows any more which key opens what.
- An employee or a contractor has left, and you are not sure you cut all of their access.
- A client, an auditor or your insurer asks you how your access is protected.
What you receive
- The inventory of your secrets: where your passwords and keys live, who accesses them, and what has already leaked.
- The search for leaks in your code repositories and their history, your publishing pipelines and your shared tools, with every exposed key revoked and replaced.
- A vault opened in your name, on your server or with a host in Europe, organised by team and by environment.
- Your automations and AI agents connected to the vault: each key is added at the moment of the call, never shown to the model.
- A safeguard that blocks a secret before it enters a code repository.
- The handover: our access removed, the keys seen during the project changed, a recovery procedure tested with your team and clear documentation.
How it goes
-
Inventory
We look for where your secrets live and what has already leaked. You receive the list, and every exposed key is revoked then replaced.
-
Vault
The vault is opened in your name and organised by team and by environment, with one identity per person, per automation and per agent.
-
Connection
Your tools, automations and agents move to the vault one after the other. Old copies are only deleted once the relay has been checked.
Handover
Our access is removed, the keys we came across are changed, and your team tests the recovery procedure with us.
Frequently asked questions
How can an AI use a key without seeing it?
It never receives it. It asks for an action, for example sending a quote, and a relay placed between it and the service adds the key at the moment the request leaves, only towards the intended address. Even when tricked by an instruction hidden in a document, the AI has nothing to disclose.
A key has leaked: what should be done first?
Revoke it with the service that issued it, before anything else. According to GitHub’s documentation, this is the first step: a key pushed to a repository stays readable in its clones and forks, even once erased from the history. With the vault, you replace it once and every connected tool receives the new one, with no hunt for copies.
Aren’t environment variables enough?
They beat a key written in the code, but OWASP, a non-profit foundation dedicated to software security, advises against them in its guide on secrets management when another method is possible: they are generally readable by every process on the machine and can end up in logs. With the vault, the original stays in one place, each tool only receives what it needs and every use is recorded in the log.
Does the vault help us comply with the GDPR?
It contributes, without being enough on its own. Article 32 of the GDPR requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the confidentiality of the systems that process the data. The vault covers this for your access: everyone only has the rights they need, and every use is recorded in the log.
Is the vault home-made?
No, and that is deliberate. The core of the vault is proven open source software whose code is public: we do not reinvent encryption. Our work is to set it up in your name, connect your tools and your AI to it, then hand you the keys.
What if we lose access to the vault?
It is planned from the start: a recovery procedure, written and tested with your team, entrusts recovery to two people you designate. We keep no duplicate, since a duplicate with us would be precisely the access we promise not to have.
Do we have to migrate everything at once?
No. Tools move to the vault one by one, starting with the most exposed keys: those of AI, automations and publishing pipelines. An old copy is only deleted once the relay has been checked, so that no service stops during the project.
Does the vault replace everyone’s password manager?
No, it sits alongside it. It holds what is shared: tool accounts used by several people, API keys, tokens, database passwords. For their personal passwords, everyone keeps their own manager, with two-factor authentication wherever it exists.
Where is the data stored?
On your server or with a vault host in the European Union, always in your name. Values are encrypted, and the AI model working for you never receives them, whatever its provider.
Rarely just one service. Most of our clients combine several: build your cart and ask for a bundled quote, a set of services gets a better price.
Build a bundled quoteGo further on this topic
Business AI: private and at the right cost
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
When OpenAI's agents hacked Hugging Face
In July 2026, OpenAI agents in the middle of a cybersecurity exam escaped their sandbox and hacked Hugging Face to cheat. What happened, why, and what the affair says about the technology, how agents organise themselves and our responsibilities.
Who enforces the AI Act in France? The law is still pending
Adopted by the French Senate on 18 February 2026, the bill naming the AI Act enforcement authorities is still waiting for the National Assembly. Who would supervise what under the Senate text, what already applies without it, and what a business can prepare in the meantime.
Go further on this topic
Infrastructure and cloud: hosting, operating, leaving SaaS
Cloud and AI Development Act: tripling data centres
Presented on 3 June 2026, the Cloud and AI Development Act aims to triple European data centre capacity and to create a four-level sovereignty scale for public cloud procurement. What the proposal contains, where negotiations stand, and what still holds when choosing a hosting provider today.
Data Act: cloud switching charges end in January 2027
From 12 January 2027, a cloud provider can no longer charge for switching providers, and new connected devices already have to give users their data. What the Data Act lets you demand, and what it will not do for you.
Cloud infrastructure: the foundation for all your projects
Before the first project, a cloud infrastructure foundation settles accounts, access, backups and budget once and for all, and every later project inherits it. What it contains, where to put it, what it costs and why running it matters more than installing it.
20-minute diagnostic
Twenty minutes on a call, two or three concrete leads, no strings attached.
We look at your situation, identify what can be automated or improved, and tell you plainly whether we can help.