Credential vault
The agent never sees the secret in the clear
The credential vault holds the passwords, tokens and API keys an AI agent needs to use. The agent asks for the action, the vault performs the authentication, and the secret never shows up in clear text in the conversation or in the history. This is the piece that separates an agent working inside your systems from an agent leaking your systems.
What changes in your day
- The secret is injected at the moment of use and never enters the language model context.
- Every credential has a scope: which agent may use it, in which system, and for how long.
- Usage record: when the key was used, by which agent, and for which action.
- The vault lives on your machine or your server, next to the rest of the operation.
Frequently asked questions
Why can the agent not just receive the password?
Because anything that enters the conversation with the model becomes text that can be logged, forwarded or read by mistake. A password in plain text is a leaked password waiting for its turn. The vault solves this by keeping the secret out of the conversation.
What does someone find when reading the agent history?
They find the action, for example signed in to the billing system, not the credential. The value of the key is never written into the history.
Which systems does the vault work with?
Systems that authenticate by password, by token or by API key. Each one is configured during the project, together with its usage scope and expiry.
Who can see the secrets?
Only the people you authorise inside your own environment. ORCH Data does not host your vault and holds no copy of your keys.
Seats open in batches. No spam, and you can leave whenever you want.