Unified Platform Architecture

One platform for keys, certificates and secrets

MazeVault combines secrets management, certificate management, agent management and an integration hub in a single platform. Administrators work in the web console, while pipelines and scripts use the CLI, the SDKs for Go, Python, Java and Node.js, or the REST API. Sign-in works with Microsoft Entra ID, LDAP, SAML, GitHub and GitLab, and users can be provisioned through SCIM.

Certificates come from 10 certificate authorities: DigiCert, Let's Encrypt, ZeroSSL, SSLmarket, I.CA, Microsoft AD CS, Venafi, smallstep, HashiCorp Vault PKI and the built-in internal CA. A built-in ACME server lets cert-manager in Kubernetes request certificates from any of them, and a SCEP server covers network devices. Cross-platform agents for Windows and Linux discover certificates in files, Java keystores and the Windows certificate store, bind them to IIS and deploy renewed certificates.

Secret rotation covers PostgreSQL, Oracle, Microsoft SQL Server, MySQL, MongoDB and Redis passwords, Microsoft Entra ID app credentials, Kerberos keytabs and SSH keys. Secrets sync to Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager, OCI Vault, GitHub, GitLab and Azure DevOps, and reach applications through the Kubernetes operator, Terraform provider, Ansible module and Jenkins plugin.

Actions are recorded in a hash-chained audit log that can be streamed to Splunk, Elastic or syslog, with ready-made detection rules for Splunk, Elastic, Microsoft Sentinel and IBM QRadar. Compliance reports for PCI DSS, SOC 2, GDPR and ISO 27001 export to PDF. MazeVault installs on-premise with Docker or Helm, including an offline installer for air-gapped networks, or runs in gateway mode with a standby gateway for disaster-recovery failover.