Your project secrets,
safe in the vault.
API tokens, database passwords, certificates and confidential notes — all live in per-project, end-to-end encrypted vaults right next to the tasks that use them.
https://api.taskerwork.com/v2••••••••••••••••••••••••••••••••••••••••Four layers of encryption, zero grey area.
Every secret is protected by an envelope encryption hierarchy with four independent layers. Each layer has its own key and its own encryption context.
- AES-256-GCM authenticated encryption — a single byte change in ciphertext fails decryption
- KEK derived with PBKDF2-SHA256 at 600,000 iterations
- Per-vault Vault Master Key (VMK) wrapped with AES-256-GCM
- Per-secret Data Encryption Key (DEK) derived deterministically with HKDF-SHA256 — no extra storage
- Key versioning — rotating the KEK only re-wraps VMKs, no ciphertext is touched
The right shape for every secret.
Plain-text tokens, structured key-value blocks, binary files or markdown notes — every secret type is stored and rendered the way it makes sense.
- TEXT — single-line values for API tokens, S3 keys, JWT secrets
- KEY_VALUE — key-value groups for DB connection strings, OAuth credentials
- FILE — .pem, .key, JSON service account files (up to 256 KB)
- NOTE — rich markdown notes for recovery codes, on-call playbooks
- All types share the same encryption pipeline; the UI picks the right viewer
Every reveal, on the record.
Anyone who looks at a secret always creates an audit log entry. Reveal is never cached client-side — every fetch round-trips to the server and leaves a trail.
- All CREATE, READ, UPDATE, DELETE, REVEAL and ROTATE events persisted
- Each entry stores IP address, User-Agent, user, target secret and timestamp
- Reveal is never client-cached — every call hits the server for audit accuracy
- Filtered views: search by secret, action type or user
- Exportable log stream for compliance and incident response
AES-256-GCM — the same cipher TLS, AWS and governments use
Tasker Work runs on the same cryptographic standard behind TLS 1.3, AWS S3 server-side encryption and Apple iCloud. 2^256 possible key combinations push brute-force attacks far past the age of the universe, and GCM mode catches even a single byte of tampering in the ciphertext and refuses to decrypt.
Exactly the right access for every secret.
Role-based access at the vault level — project membership is not enough; you must be explicitly invited to every vault.
Admin
Workspace- Create, rename and delete vaults
- Add, remove and re-role members
- View the full audit log
- Full secret CRUD across the workspace
Editor
Per vault- Create & edit secrets
- Reveal any secret in the vault
- Trigger key rotation
- Cannot manage members or delete vault
Viewer
Per vault- Read-only access to secrets
- Every reveal still logged
- Cannot create or edit
- Cannot rotate or delete
Your secrets,
with their projects.
Secret Vault keeps shared passwords and tokens in the same place as the tasks that use them — no off-the-record docs, no leak risk.