AES-256 encryption
Sensitive values encrypted at rest.
Credentials Vault: a team password vault for a startup's secrets
A secure place to store the passwords, API keys, database credentials, certificates, and other secrets your team relies on. Every sensitive value is encrypted before it's stored, so only people you've granted access can see them.
- EncryptionAES-256
- TypesMultiple
- AccessPer credential
app.nautis.io/credentials
What is Credentials Vault?
A team password vault stores the logins and secrets a company shares, encrypted, with access granted per person. The Nautis Credentials Vault holds passwords, API keys, tokens, database credentials, SSH keys, certificates and client ID and secret pairs, encrypted at rest with AES-256. Each credential is visible only to its owner, the teammates you add under Shared Access and owner-level roles. You can import from common password managers and export to an encrypted file.
In most early teams the Stripe key is in a chat message, the AWS root login is in a founder's notes app and the database password is in a README. Nobody decided that. It just happened, one urgent request at a time. The vault gives those secrets a proper home, next to the rest of the company's operating data, with a form for each type so the right fields show up: hostname and port for a database, client ID and client secret for an OAuth app, a strength meter for passwords.
Access is the point. A credential you create is visible to you, to anyone you pick under Shared Access, and to owners. Everyone else in the organization doesn't see it at all, not even its name. When someone leaves and their account is removed, they lose access automatically. Values are hidden by default; the eye icon reveals one, the copy icon copies it, and reveals hide themselves again after a short time.
Moving in is quick. Import reads the Nautis CSV template, a Nautis encrypted export, or CSV exports from 1Password, Bitwarden, LastPass, Chrome, Edge, Brave or Firefox. The file is read in your browser and nothing from it is sent to AI. The Credentials Vault guide lists every field per type.
Built for
- Founders storing critical credentials safely
- Teams onboarding new engineers
- Operators moving secrets out of spreadsheets and chat
Capabilities
What you can do with Credentials Vault
Everything ships out of the box. No setup, no plugins, no extra tools.
Multiple types
Passwords, API keys, database creds, certificates, free-form secrets.
Folders & search
Organize at scale and find by name or type.
Role gating
Only people with explicit access can read each credential.
List & cards view
Pick the layout that fits your workflow.
Use cases
How startups use Credentials Vault
Onboarding a new engineer in ten minutes
Keep a Staging folder and a Production folder. On day one, add the new engineer under Shared Access on the staging database, the staging API keys and the error tracker login. Production waits until they've shipped something.
Getting secrets out of a shared spreadsheet
Download the template from Import, which has one sample row per credential type, move the rows across, and import. Leave Skip duplicates on. Then delete the spreadsheet, which is the step most teams forget.
Offboarding a contractor
Remove the contractor from the organization and their vault access goes with it. Then open the folder they used and rotate each underlying secret with the provider, because they may have copied a value while they had access.
Moving to another password manager later
An owner or admin chooses Export and picks the Unencrypted CSV, confirms with their password and authenticator code, and imports the file elsewhere. The workspace owner gets an email about the export. Delete the CSV straight afterwards.
Quick start
From zero to using Credentials Vault
- 1
Click New credential
Sidebar → Profile & Company → Credentials Vault.
- 2
Pick the type
Password, API key, database, certificate.
- 3
Fill the secret
Stored encrypted from the moment you save.
- 4
Grant access
Pick teammates who can decrypt the value.
What AI can and can't see in the vault
AI apps connected to your workspace, such as Claude or ChatGPT, can read a credential's name and details, like its type and web address, but never the secret value. That keeps the vault useful as context ("which services do we have keys for?") without handing an AI the keys.
Adding or updating a vault entry through a connection is one of the few writes that never waits for approval, because a waiting approval would have to store the secret. Those writes still need write access and the right role permissions. The rules are in Connect Claude and ChatGPT.
A team password vault in Nautis vs a dedicated password manager vs a spreadsheet
If your team needs browser autofill on every site, a dedicated password manager is the right tool. The vault fits teams that want company secrets stored and shared next to the rest of their operations.
| Need | Shared spreadsheet or doc | Nautis Credentials Vault | Dedicated password manager |
|---|---|---|---|
| Encryption of stored values | No | AES-256 at rest | Yes |
| Access per credential | Whoever has the link | Owner, Shared Access list and owners | Yes, usually by vault or item |
| Types beyond passwords | Whatever you type | API key, token, database, SSH key, certificate, client ID and secret | Varies by product |
| Import from other managers | Copy and paste | 1Password, Bitwarden, LastPass and browser CSVs | Usually yes |
| Browser autofill | No | No. Copy the value | Yes, the main reason to buy one |
| Exports logged and emailed to the owner | No | Yes | Varies by product |
Plans and limits
- The Credentials Vault must be enabled for your organization. Your plan may cap how many credentials you can add each month, and imports count toward that limit. See pricing.
What Credentials Vault doesn't do
- There's no browser extension or autofill described in the guide. You reveal or copy a value and paste it.
- Deleting a credential is permanent. There's no recovery.
- Search matches names and descriptions only, so write a clear description or you'll struggle to find the right key later.
- Cards and identities exported from password managers aren't imported. Rows missing a required field, like a password without a username, are skipped.
- If you lose the passphrase for an encrypted export, nobody can open that file. Nautis doesn't keep it.
Credentials Vault questions
Is a team password vault safer than a shared spreadsheet?+
Yes, for two reasons. Values are encrypted at rest, so they aren't sitting in plain text, and access is per credential, so a link forwarded to the wrong person doesn't expose everything. Rotating secrets when people leave still matters either way.
Can I import passwords from 1Password or Bitwarden?+
Yes. Export a CSV from 1Password, Bitwarden, LastPass, Chrome, Edge, Brave or Firefox and use Import. Nautis maps the columns, shows a masked preview and skips duplicates by name and type.
Is an encrypted vault export safe to keep?+
Safer than a CSV. A .nautisvault file can only be opened by importing it into Nautis with the passphrase you chose, which must be at least 12 characters. Nautis doesn't keep the passphrase, so store it somewhere separate from the file.
Can I store SSH keys and certificates?+
Yes. Both are their own credential types, alongside passwords, API keys, tokens, database credentials, client ID and secret pairs, and an Other type for anything else.
Why do I need two-factor authentication to export?+
Nautis asks for your password and authenticator code to confirm it's really you. If you signed up with Google or another social login and don't use two-factor authentication, turn it on in Account Settings → Security first.
Who can see my credentials?+
Only you (the owner) and the teammates you've explicitly added under Shared Access. Members of your org without that share won't see the credential at all.
Can Nautis support staff read my passwords?+
No. Secret values are encrypted before they leave your browser-side request. They're decrypted only when an authorised user opens them in the UI.
What happens to shared credentials when a teammate leaves?+
When their account is removed from your organization, they lose access automatically. You may want to rotate the underlying secret as a precaution.
Can I export my credentials?+
Yes, if you're a workspace owner or admin. Choose an encrypted .nautisvault file with a passphrase (recommended) or an unencrypted CSV for moving to another password manager. The owner is emailed about every export and it's recorded in the audit log.
What's the difference between Client ID / Secret, API Key, and Token?+
They're all secrets, but each has its own form so the right labels show up. Pick the one that matches what your service calls it; if in doubt, use Other.
Can I recover a deleted credential?+
No. Delete is permanent — that's why Nautis asks you to confirm.
Is there a master password?+
Access is gated by Nautis auth + module permissions. Strong account security (2FA) is recommended.
Does search look inside secret values?+
No. Search in the sidebar matches credential names and descriptions only. Secret values stay encrypted with AES-256 and are decrypted only when an authorised user reveals them.
Your first hire, before your first hire
Hire your Chief of Staff today.
Full business context from the first conversation. Daily operations, fundraising, revenue and finance, run with you. You approve every move. It handles the rest.
Nothing leaves your workspace without your yes.