One vault per purpose
"Home", "Backups", "Office": each vault carries its own encryption key. Everyone only sees what belongs to them or what has been shared with them.
SYNACKSYS // Open Source
Open code, auditable, usable without us.
Alongside the commercial suite, we publish free software. No crippled edition, no feature held back: the repository holds everything we run ourselves.
Open source - AGPL-3.0
SYNSEC
Your secrets stay at home.
A secrets server for the home: a single binary, no database to install, no runtime to maintain. Passwords, API keys and tokens stay encrypted on your own machine, and your devices - Home Assistant, Zigbee, MQTT, backup scripts - come and fetch them on their own. Written in Go, released under the AGPL-3.0 licence.
$ synsec init $ synsec cert trust $ synsec utilisateur create cyril $ synsec service install # then https://<machine>:8787/
Web, CLI and REST API
The same vaults, the same secrets, the same permissions everywhere. Dedicated tokens so your devices and scripts authenticate on their own.
Encrypted and audited
XChaCha20-Poly1305 encryption per vault: a stolen disk or a lost backup stays unreadable. Every read leaves a named entry in the audit log.
One binary, nothing else
No C dependencies: a Windows service or a systemd unit, back up and running after a power cut with nobody around. Linux, macOS, Synology, Raspberry Pi.
Straight talk on the threat model. The root key is unsealed automatically at startup - that is what lets a home automation box reboot at three in the morning with nobody around. An operating system administrator can therefore obtain that key and read the database. What is covered and what is not is documented plainly in the repository.
Feedback, a bug, an idea?
SYNSEC is young. Bug reports, feature requests and code reviews are all welcome, on the repository or by email.
Open an issue