Zero-Knowledge Secrets

ZenoVault

The Source of Truth for Your Secrets

Enterprise-grade secrets management with zero-knowledge architecture. ZenoVault cannot access your secrets without explicit human intervention through a distributed unsealing ceremony.

4-Layer
Encryption
Zero
Knowledge
K8s
Native
Architecture

True Zero-Knowledge Design

Unlike traditional vaults, ZenoVault is architecturally incapable of accessing your secrets. The service starts sealed and requires a distributed ceremony to unseal.

Sealed State Default

ZenoVault starts sealed on every restart. Data operations are rejected until the unsealing ceremony completes.

Distributed Unsealing

Uses Shamir's Secret Sharing to distribute trust. No single person can access secrets alone.

Memory-Protected Keys

Root key exists only in encrypted RAM using memguard with mlock. Never touches disk.

Automatic Resealing

On restart, the vault automatically reseals with complete memory wipe. No persistent key exposure.

Security

Four-Layer Envelope Encryption

Every secret is protected by multiple layers of encryption, each with its own key hierarchy.

Layer 1

Root Key (RK)

256-bit AES key, RAM only, reconstructed via Shamir's Secret Sharing

Layer 2

Key Encryption Key (KEK)

Per-vault key, encrypted by Root Key. Vault isolation guaranteed.

Layer 3

Data Encryption Key (DEK)

Per-secret-version key, encrypted by KEK. Built-in key rotation.

Layer 4

Ciphertext

Actual secret encrypted with AES-256-GCM using the DEK

Integration

Kubernetes Native

First-class Kubernetes integration with a custom operator and CRDs for automatic secret synchronization.

ZenoVault Operator

Kubernetes controller for automatic secret synchronization using the RemoteSecret CRD.

OIDC Authentication

Native K8s service account tokens validated via OIDC. No credential files needed.

Auto-Sync

Secrets automatically synced to Kubernetes native Secrets. Configurable refresh intervals.

Multi-Environment

Create isolated vaults for production, staging, and development. Each with its own KEK.

Features

Enterprise Ready

Everything you need for production secrets management.

Authentication

  • Root token for initial setup
  • Session tokens with policies
  • Kubernetes OIDC integration
  • Fine-grained RBAC

Secret Management

  • Automatic versioning
  • Key rotation per version
  • Historical version retrieval
  • Multi-tenant vaults

Administration

  • Beautiful web UI for ceremonies
  • Terminal UI (vaultctl)
  • Full REST API
  • Comprehensive audit logs
Use Cases

Built For

Production Secret Management

Database passwords, API keys, certificates - all securely stored with zero-knowledge guarantees.

Kubernetes Secret Distribution

Multi-cluster, multi-namespace deployments with automatic synchronization.

Compliance Requirements

Zero-knowledge architecture for PCI-DSS, HIPAA, SOC2, and other regulated environments.

Distributed Teams

Shamir's Secret Sharing for trusted custody across team members and locations.

Secure Your Secrets

Experience true zero-knowledge secrets management. Contact us for a demo or visit the ZenoVault website.