HashiCorp Vault Enterprise. Fully Managed. Your Secrets Stay Yours.

The Secrets Problem at Scale

Most mid-market organizations are running Vault the hard way — a self-managed cluster someone stood up three years ago, maintained by one engineer who has since left, with root token rotation that hasn’t happened since deployment. Or they’re managing secrets in environment variables, CI/CD pipelines, and shared password managers — and calling it good enough.

It isn’t good enough. Credential-based intrusion is the leading initial access vector in enterprise breaches. The gap isn’t awareness — it’s operational capacity. Running Vault Enterprise correctly requires dedicated expertise: HA configuration, namespace isolation, audit pipeline management, token lifecycle hygiene, DR failover, and compliance evidence collection. That’s a full-time platform engineering function most organizations can’t justify.

ArmorVault closes that gap without requiring you to build it.

From Contract to Operational in Hours

1. Intake & Configuration

You specify your authentication method (AppRole, OIDC/SSO, Kubernetes, or Active Directory/LDAP), audit sink destination, compliance framework, and retention requirements. Our provisioning wizard scaffolds the entire Terraform configuration.

2. Namespace Provisioned

Armorstack applies the configuration through Terraform Cloud. Your Vault Enterprise namespace is created, your chosen auth method is mounted and configured, your audit device is wired to your sink, and your access policies are in place.

3. Credential Ceremony

You receive your initial AppRole credentials or OIDC configuration through a guided onboarding flow. No shared secrets, no emailed credentials — your initial access is generated live and displayed once.

4. Ongoing Operations

Armorstack monitors platform health, applies Vault version updates, maintains audit pipeline continuity, and provides break-glass emergency access under dual-control procedures. You operate your namespace through the Vault API, Vault Agent, or the ArmorVault portal.

Built to Satisfy the Frameworks Your Auditors Care About

ArmorVault is designed for regulated mid-market organizations. Compliance framework selection at onboarding tightens token TTLs, audit retention requirements, and operational controls to match your audit obligations.

• SOC 2 Type II — Audit pipeline continuity, privileged access review (PAR) evidence, platform change management
• HIPAA — Namespace isolation, encryption at rest and in transit, BAA available, operator access controls
• PCI DSS — Hardened token lifetimes (4h maximum), full cardholder data environment audit logging
• NERC CIP — Operational technology secrets separation, compliance-aware access TTL enforcement
• CMMC 2.0 — CUI handling requirements, audit evidence collection, access review documentation

Evidence delivery: Every privileged access event generates a structured SSM audit record. Monthly PAR (Privileged Access Review) reports are available on demand, formatted for SOC 2 CC6.3 / CC6.6 evidence submission.

Why “Managed” Doesn’t Mean “They Can Read Your Secrets”

The objection every CISO raises: if Armorstack runs the infrastructure, can Armorstack read our secrets? The architecture is designed to answer that question with a provable no.

Namespace isolation

Your secrets exist in a Vault Enterprise namespace cryptographically separated from every other tenant. There is no administrative path across namespace boundaries.

BYOK

On Enterprise tier, you supply an AWS KMS key that Armorstack never holds. Vault uses your key to encrypt your namespace’s secrets at rest. Without your KMS key, the data is ciphertext.

Just-in-time operator access

When Armorstack platform engineers need access to your namespace (for example, during a P1 incident), they issue a token scoped to your namespace with a hard 8-hour TTL. That token is generated from a break-glass Vault role, requires dual-control authorization (a named approver), and every issuance is permanently logged to AWS SSM. There are no standing operator credentials.

Audit delivery to your account

Vault audit logs are shipped to your S3 bucket or your Cloudflare R2 bucket — in your cloud account. Armorstack does not hold copies. You can verify every operation independently.

Part of the Armorstack SENTRY Portfolio

ArmorVault is the managed infrastructure offering within the SENTRY cybersecurity portfolio. It pairs with:

• SENTRY MDR — Threat detection and response that can ingest Vault audit logs as a signal source for credential-based attack detection.
• SENTRY Pulse — AI-powered security observability, including detection of secrets exfiltration and unauthorized namespace access patterns.
• VERITY vCISO — Strategic advisory for organizations building a full credential governance program around ArmorVault.

Existing SENTRY and CORE clients receive preferred onboarding pricing.