TenthMatrix WSL Vault
Steal the server. Not the secrets.
Open-source, self-hosted secrets management built on AES-256-GCM envelope encryption and a per-tenant key hierarchy — so a stolen disk, database dump, or compromised host still leaves attackers with ciphertext they cannot open.
What is WSLVault?
WSLVault is a Vault-compatible secrets platform for operators who want encrypted-at-rest multi-tenancy without plaintext on disk. Drive it from the steel/brass web console, CLI, Go/Python/Rust/TypeScript SDKs, or MCP — with Helm/GitOps deploy on Kubernetes.
Watch the overview
20-minute intro — steal the server, not the secrets
Watch on YouTube
Watch on YouTube: 20-minute intro — steal the server, not the secrets
Why the security model matters
True multi-tenancy
Team A cannot decrypt Team B — cryptographic refusal, not an application oops.
Envelope encryption
DEK → tenant KEK → root KEK (KMS / HSM / Shamir). Secrets sealed before they touch disk.
Engines you need
Versioned KV, transit encryption, PKI, dynamic leases, identity policies, and MFA.
HA & audit
Active/active multi-region replication and a tamper-evident, hash-chained audit trail.
Everything a secret needs, behind one API
Versioned KV secrets
Vault-compatible KV v2: versioned reads/writes, check-and-set, soft-delete and destroy — every value sealed before storage.
Transit engine
Encrypt, decrypt, sign and verify without plaintext keys leaving the vault. Rotate keys while old ciphertext stays readable.
PKI & certificates
Private CA, roles, and short-lived certificates. CA private keys are envelope-encrypted, never stored in the clear.
Dynamic leases
Credentials are leases: issued, listed, renewed, and revoked for real. Revoke stops access immediately.
Identity & MFA
TOTP two-factor, recovery codes, fine-grained policies on API keys and JWTs — plus SCIM, LDAP, OIDC, mTLS and workload auth.
Zero plaintext at rest
A database dump yields ciphertext wrapped under keys the database never sees. Steal the disk ≠ steal the secrets.
Cloud-native and scriptable
Ship with the Helm chart and Kubernetes operator, drive from GitOps, scrape with Prometheus, and reach WSLVault from your language of choice — or from an AI agent over the built-in MCP server.
Stand up your own vault
Clone the repo, install the Helm chart, and unseal. TenthMatrix helps operators run WSLVault with the same edge and promotion discipline as WSL Proxy and Ring Promoter.