Secrets and metadata kept separate
Title, destination and notes describe the record; passwords and sensitive content remain encrypted.
Password Vault
I secret restano segreti.Even from the server that stores them.
Argus protects credentials, passwords, confidential notes and attachments through browser-side encryption. The server stores encrypted content, metadata, protected keys, permissions and audit records.
AES
Browser-side encryptionThe Vault Phrase and plaintext keys are never sent to the server
ERP
ERP administratorCompany · tag Produzione
SharedFW
Site firewallHost Network Discovery
PrivateDB
Reporting database2 encrypted attachments · 4 versions
CompanyBrowser
readable secret
readable secret
Server
ciphertext
ciphertext
01 Vault02 Credentials03 Sharing04 Governance
Zero-knowledge repository
Centralize credentials without handing secrets to the server.
The browser encrypts content and prepares keys for authorized recipients. Argus can govern access, history and recovery without independently decrypting stored passwords.
Encrypted documents
Files are protected before upload and require the key associated with their version.
Linked resources
Link a credential to endpoints, Network Discovery hosts or generic services.
Personal favorites and tags
Find what you use quickly without imposing the same organization on other users.
01 · Overview
One place to find, distinguish and use credentials.
The main page distinguishes private, company and shared credentials at a glance. Counters highlight expiring items and records in the recycle bin, while search and filters quickly narrow the scope.
- Compact, list and grid views adapt information density.
- Favorites, personal tags and linked resources make information easy to retrieve.
- Direct actions to edit, share, view, copy or open the audit trail.
- Temporary Vault session that can be locked manually and renewed from the browser.
02 · Credential details
The secret is only one part of the context.
Each record also describes where and how it is used: access type, authentication method, account, destination, expiration, encrypted notes and a linked Argus resource.
Operational metadataTitle, company, resource and URL identify the credential without exposing its content.
Expiration and remindersDates reveal credentials that should be renewed before they become an operational problem.
Favorites and tagsThey are personal and organize each user’s work without changing how others classify the record.
Secret versionUpdating a password creates a new version distinct from ordinary descriptive changes.
03 · Audit
Know who did what and when.
The audit trail reconstructs the credential lifecycle: creation, changes, transfer to the company, viewing and copying the secret. Each event retains the user, date, time and details such as the affected version.
- History distinguishes viewing a secret from changing metadata.
- Versions connect each action to the correct encrypted content.
- The audit records the operation without revealing the secret value.
- Pagination keeps long histories easy to inspect.
04 · Sharing
Sharing means assigning a role, not duplicating a password.
The owner chooses the recipient and role. Only eligible users with an active Vault and a public key ready to receive the encrypted credential key are available.
Owner
Manages content, versions, sharing and the credential lifecycle.
Co-manager
Collaborates according to granted permissions, reducing dependence on one person.
Reader
Can use the secret without receiving the owner’s administrative capabilities.
Revocation protects future access. It cannot retrieve copies a recipient has already exported or used outside the Vault.
05 · Vault Company Manager
A governance responsibility, not a universal key.
The Vault Company Manager is responsible for company credentials. The VCM reviews security status, oversees key alignment and can reassign credentials when an owner is no longer available.
- The role applies only to its own company and does not grant access to private Vaults.
- Being a VCM does not automatically make all credentials readable.
- At least one confirmed VCM must remain to ensure governance continuity.
- Company recovery adds a recovery path but requires correctly prepared procedures and keys.
06 · Vault Security Status
Security becomes a list of verifiable conditions.
This view does not assign a generic score: it counts conditions requiring attention and explains corrective action. Technicians can quickly distinguish healthy governance from a credential at risk of becoming unmanageable.
GovernanceConfirmed VCMs, governed companies, expired appointments and organizational anomalies.
ContinuityInactive owners, credentials to reassign and missing co-managers.
LifecycleItems to verify, expiring or already expired.
Keys and recoveryMissing company recovery and unavailable wrapped keys for authorized recipients.
“Align all” is a maintenance action. It realigns the expected keys; it does not make secrets readable when authorization or valid cryptographic material is missing.
Cryptographic boundary
Security is visible. The secret remains encrypted.
The Monitor can highlight missing roles, expirations, governance issues and keys that require alignment. It cannot bypass the zero-knowledge model to reconstruct content without the necessary keys.
Unlocking is temporary.The Vault Phrase opens the browser session. On shared devices, lock the Vault as soon as the session ends.