CEDX Vault · IT & Security
CEDX Vault keeps the estate's secrets in 42 namespaces with owners, environments and rotation SLAs — and it puts the uncomfortable numbers on the Overview: 134 past policy, 27 never rotated, rotation health at 58%.
The oldest row in the demo is 659 days old with a 629-day lag past its SLA. The table does not round that down, sort it away, or call it anything else.
Runs on demo data — Northline is the software's sample tenant, not a customer.
What it is
The Secrets table carries type, owner class, environment, age and lag on every row — an SSH key at 659 days old and 629 days past policy sorts to the top, exactly where it belongs. Agent-owned identities are their own filter: 36 of them.
Namespaces are scored, not just listed: prod/payments carries risk 86 with 3 secrets and 22 grants; shared/infra holds 8 secrets against 30 grants. Environment and kind — production, staging, shared, personal — are columns, not folklore.
180 rotation jobs, 58% on SLA, 80 lagging past policy, 28 failed with last-run error, 26 never bound to an engine. Six policies set the terms — production default 90 days, payments tight 60, break-glass 30, certificates annual 365.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/vault.
01 — Overview
320 secrets across 42 vaults, 101 at high age risk, and a posture ring at 49 — pulled down by the 27 never-rotated standing keys. The root-caused alerts name the worst of it: 9 production payment secrets past the 90-day SLA.
02 — Secrets
webhook-rw-214 is an SSH key in prod/analytics, human-owned, 659 days old, 629 past its rotation SLA. legacy-ftp-password is 610 days old in a shared vault. The filter chips isolate what you came for: agent-owned, never rotated, past SLA.
03 — Vaults
prod/payments, prod/finance, prod/deploy sit at the top of the risk sort — 86, 82, 78 — each with a named owner and a grant count. A vault is a boundary you can review, not a folder you hope nobody opened.
04 — Rotation
Most of the lagging rows have never rotated — status “Never”, engine “None”. That is the finding: not failed rotation, but rotation that was never bound. The policy table next to the queue says what each class of secret owes.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns the rotation queue and the policies behind it — and the 26 secrets that were never bound to an engine in the first place.
never bound · 26
Keeps the prod namespaces — payments at 60-day SLA, the deploy keys, the CI tokens — inside policy and bound to an engine.
prod/payments · risk 86
Reads the grant counts per vault and asks why shared/infra has 30 grants against 8 secrets.
shared/infra · 30 grantsThe shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
A secret lands in a namespace with an owner, an environment and a type — and the access log starts from the first read.
Rotation policy attaches by class: production default 90 days, payments 60, break-glass 30. The 26 never-bound rows are what happens when this step is skipped.
The engine runs the job and records the outcome — on SLA, lagging, or failed with the last-run error on the row.
Age, lag and access events roll up to the Overview: 134 past SLA, 27 never rotated, and a root-caused alert for the payment secrets past 90 days.
One record
A secret is not an island of text — it is read by identities, scoped by grants, and asked about by auditors. Those records already exist in the estate.
The 22 grants against prod/payments are the same grants Access reviews — standing versus just-in-time, used or idle for 90 days.
CEDX SIEM1.2K access events in 7 days feed the same signal stream the SOC reads — a secret read off-hours is an event, not a surprise.
CEDX ComplianceRotation policy and evidence age are exactly what a controls library tests — the 134 past-SLA rows are gaps with owners.
CEDX EndpointThe deploy keys and CI tokens land on devices Endpoint scores — exposure follows the secret to the host.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your namespaces, your policies
Vault with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/vault. It runs on demo data — Northline is the sample tenant.
A secret with no rotation engine attached: it sits in the vault ageing, with no job that will ever rotate it. The Rotation screen counts 26 of them and marks their status “Never” — the point of the screen is that you can see them.
Policies set the SLA by class — production default 90 days, payments tight 60, CI tokens 90, break-glass 30, certificates annual 365, staging relaxed 180. Each secret shows its SLA next to its actual lag in days.
The Overview counts 1.2K access events over 7 days across the 320 secrets; reads are events on the same record the rest of the estate shares.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then ask how old your oldest standing key is.