HashiCorp Vault

A secrets management service that keeps credentials, API keys, certificates and encryption keys in an encrypted, access-controlled backend. HashiCorp Vault issues short-lived dynamic secrets on demand, provides encryption as a service through its transit engine, and can act as a certificate authority, while policies decide which identities may read or write each secret.

Platform teams use it to pull credentials out of code, rotate database passwords automatically and audit access.

Running Vault on your own infrastructure keeps the master keys and secret values under your control, avoids per-seat pricing for developers who need access, and leaves you a database you can snapshot and restore.