---
title: "Vault"
description: "WorkOS Vault is a developer-friendly EKM to encrypt and optionally store data including tokens, passwords, certificates, files, and any other customer content."
url: https://workos.com/vault
---

# Vault

## Encrypt, store, and control access to sensitive data

WorkOS Vault is a developer-friendly EKM to encrypt and optionally store data including tokens, passwords, certificates, files, and any other customer content.

[Get started](https://workos.com/signup)

[Read the docs](https://workos.com/docs/vault)

### Powerful

Multiple layers of encryption protect data while keeping keys secure.

### Simple

Encrypt content by using metadata to identify data keys.

### Flexible

Store data directly in Vault or generate keys for use in applications.

## Encryption Key Management (EKM) for enterprise-ready security

WorkOS Vault provides secure storage and strict access control for any type of object data, with encryption of individual keys backed by an HSM.

## Bring-Your-Own-Key (BYOK) for the ultimate data control

Modern enterprise customers demand encryption with managed key services. WorkOS Vault integrates directly with AWS KMS, GCP KMs, Azure Key Vault, and HashiCorp Vault.

## Context-based key generation for cryptographic isolation

WorkOS Vault provides data segmentation by creating unique encryption keys tied to the user, organization, and other supplied metadata.

Z

R

1

T

I

h

9

0

B

c

X

f

m

i

## Powerful encryption. Simple integration.

The WorkOS API enables adding Enterprise Ready features to your application. This REST API provides programmatic access to version-controlled objects and data encryption keys.

[Read the docs](https://workos.com/docs/vault)

[Get your API key](https://workos.com/signup)

Node.js example

```js
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const organization = await workos.organizations.getOrganization(
  'org_01EHZNVPK3SFK441A1RGBFSHRT',
);

const encryptedObject = await workos.vault.createObject({
  name: 'external_api_key',
  value: 'supersecretapikey',
  context: { organizationId: organization.id },
});
```

### Secure by design

Data stays protected across its lifecycle - encrypted in transit, in use, and at rest.

### Easy by default

WorkOS Vault comes with guardrails so you don't shoot yourself in the foot.

### Your keys or ours

Use WorkOS Vault hosted keys, attach your own, or let your customers bring their KMS.

### EKM without the headache

HSM, CMK, KEK, DEK... disregard the acronyms and use encryption with simple tools.

## Zero trust. Full control. Enterprise-ready security.

### Any object, anywhere in the stack

Encrypt all secret and sensitive data, including customer PII, payment information, API tokens or passwords. Segment data according to its type, classification or relationships.

### Envelope encryption and per-customer key segmentation

Generate data encryption keys to cryptographically protect data stored in internal systems. All keys are scoped to organizations, sessions or arbitrary context for optimized compute speed.

### Audit every interaction with encrypted objects

- Detailed log of all activity through observability telemetry.
- Pipe audit events into log aggregators, SOARs or SIEMs to monitor object and key use.

### On-demand key rotation and revocation

- Rotate keys on demand, on a schedule, or any sequence using Vault's flexible key context.
- Restrict access to data by revoking keys which disables decryption.

### Field-level encryption for content separation

- Scope encryption keys using content metadata to create logical segregation.
- Encrypt entire objects or individual fields based on data sensitivity.

## Keep it secret. Keep it safe.

Request access to begin securing sensitive data and secrets in your app today.

[Get started](https://workos.com/signup)

[Read the docs](https://workos.com/docs/vault)

[Vault Quick StartJump into the docs and get protected in minutes.](https://workos.com/docs/vault/quick-start)[**Read the launch blog**Learn about all of Vault's features that enhance your security](https://workos.com/blog/vault)