Getting Started with StretchVault

StretchVault is where your organization stores and governs its secrets — passwords, secure notes, server logins, API keys, and payment cards. This article introduces the core ideas and shows you around so the rest of the documentation makes sense.

What StretchVault is

StretchVault is the StretchSuite equivalent of an enterprise password manager. Instead of tracking credentials in a spreadsheet or pasting them into chat, you keep them in encrypted vaults, share them under explicit permission, and review their security posture from one place.

Every secret you store is encrypted at rest with AES-256-GCM encryption before it is written to the database. StretchVault treats secret values as sensitive by default: everywhere a list of items appears — dashboards, search, reports — you see only metadata (title, username, URL, tags, strength, exposure). The secret value itself is never included in those views. Seeing a secret is a separate, deliberate action called a reveal, and every reveal is logged.

Key concepts

• Vault — a secure container that groups related items, for example Shared Ops, Marketing SaaS, or Client Credentials. Every item lives in exactly one vault.
• Item — a single stored record. Items have a type: Login, Secure note, Server, API key, or Payment card.
• Secret — the confidential value on an item (the password, key, or card number). It is stored encrypted and shown only on demand.
• Reveal — the audited action of decrypting a secret so you can read or copy it.
• Grant — permission you give one person to access one item, at a chosen scope (view, reveal, or edit).
• Watchtower — the security review that scores a vault and flags weak, reused, old, or exposed credentials.

Finding your way around

Open StretchVault from the workspace navigation (under Platform & AI). Down the left side of the app you'll find the tabs that map to everything in this documentation:

1. Dashboard — a posture overview that fills in once you have at least one vault or item.
2. Vaults — create and browse your vaults.
3. Items — every stored record across your vaults, with strength and exposure at a glance.
4. Generator — create strong passwords and passphrases.
5. Health — confirm encryption is configured and the security engine is online.
6. Audit — saved Watchtower and rotation runs over time.
7. Watchtower — run a full security review of a vault.
8. Breach-watch — a fast exposure scan.
9. Sharing — grant and revoke access to individual items.
10. Folders — organize items within a vault.

(You'll also see Roadmap and Governance tabs, which show what's coming and your organization's credential policies.)

Your first five minutes

1. Open the Health tab and confirm encryption shows as enabled. This tells you StretchVault is ready to accept secrets.
2. Go to Vaults and create your first vault — name it something your team will recognize, like Shared Ops.
3. Click New vault item, choose the Login type, and add a real account you use every day.
4. Save it, then go to Items and notice the row shows the account's title and username but not the password.
5. Open the item and choose Reveal to see the secret. That action is now recorded in the access log.

A realistic example

Meridian Studio, a small agency, moves off a shared spreadsheet. They create three vaults: Internal Tools for their own accounts, Client Credentials for logins they manage on behalf of clients, and Infrastructure for servers and API keys. The owner adds each teammate to the workspace, then shares only the Client Credentials items a given account manager needs. Within an afternoon, no password is being emailed anymore, and the owner can see — in one Watchtower run — that four passwords are weak and two are reused across clients.

Tips

• Create vaults around who needs access, not just topic. A vault your whole team can see should hold different items than one only two admins should touch.
• Fill in the URL field on Login items — it powers strength checks (so your password isn't just the site name) and makes items easier to find.
• Turn on the 2FA flag for any account that has two-factor enabled. Watchtower uses it to flag accounts that don't.
• Store more than passwords: license keys, SFTP credentials, and API tokens all belong in StretchVault instead of a notes app.

FAQ

Do I need to install anything? No. StretchVault runs in your StretchSuite workspace in the browser.

Can teammates see my secrets automatically? No. Owners and admins can reveal items in vaults they administer; everyone else sees only what they've been explicitly granted.

Is my data encrypted? Yes — every secret is encrypted with AES-256-GCM before it is stored, and secret values are never returned in list views.