Credential Vault
Your credentials are encrypted end-to-end with RSA. The private key never leaves your premises. ConnectMyAssets never stores plaintext passwords.
- ✓RSA end-to-end encryption
- ✓Private key stays on your premises
- ✓Credentials never exposed to users
- ✓Per-device credential scoping
- ✓Automatic rotation support
- ✓Full access audit log
Secrets Belong in a Vault
Every design decision in the Credential Vault puts your security posture first, without sacrificing operational convenience.
RSA Encryption
Credentials are encrypted with RSA-2048. Only your appliance holds the private key.
On-Premise
The private key never leaves your infrastructure. Not even ConnectMyAssets can decrypt it.
Zero Exposure
No human ever sees a password. Credentials are fully encrypted, hidden, and injected on-the-fly at connection time. Operators never see credentials: they are used transparently at the moment of access.
Scoped Access
Each credential set is scoped to specific devices or CIDR ranges. Principle of least privilege.
Rotation Support
Update credentials centrally. All dependent automation and backup tasks update instantly.
Audit Trail
Every credential use is logged: which automation, which device, which user initiated it.
How It Works
Enter once. Encrypted immediately. Used transparently everywhere.
Add Credentials
Enter once in the Vault. Encrypted immediately with your RSA public key.
Assign to Devices
Scope credentials to devices, vendors, or CIDR ranges.
Never Touch Again
Automation, Bastion, and Backup all use Vault credentials transparently.
Frequently Asked Questions
Common questions about credential vault and network security
How are credentials encrypted in ConnectMyAssets?
All credentials stored in the Vault are encrypted with RSA-2048. Encryption happens immediately on entry, using your public key. The private key never leaves your infrastructure, meaning not even ConnectMyAssets can decrypt the stored credentials. This end-to-end encryption model ensures that even in the event of a platform breach, plaintext credentials are never exposed.
Do network engineers ever see the passwords stored in the Vault?
No. Credentials are fully encrypted and hidden at all times. Operators never see passwords: they are used transparently at connection time. When a user accesses a device through the ConnectMyAssets Bastion, the credential is injected on-the-fly directly from the Vault without ever being displayed. This zero-exposure model means even an operator with device access cannot exfiltrate the credential itself.
Can I scope credentials to specific devices or IP ranges?
Yes. Each credential set in the Vault can be scoped to specific devices, vendors, or CIDR ranges, applying the principle of least privilege. An automation task or backup job only ever uses the credential it is explicitly authorized for. There is no possibility of accidentally using a high-privilege credential on a device where it should not be used.
How does credential rotation work?
When you update a credential in the Vault, all dependent automation tasks, backup jobs, and Bastion sessions automatically use the new credential without any manual intervention. This central update model eliminates the need to hunt down every script or job that references a rotated password, reducing the risk of using stale credentials in production.
Is there an audit log for credential access?
Yes. Every use of a credential from the Vault is logged with the automation task or session that used it, the target device, the initiating user, and a timestamp. This audit trail supports security reviews, incident investigation, and compliance requirements such as PCI-DSS and ISO 27001 that mandate traceability of privileged access.
Secrets Belong in a Vault
Not in a shared spreadsheet. Not on an engineer's laptop.