Sentinel Vault
Coming soon.
A security-first secrets vault planned as the second product in the Sh-Epic suite. Token-based auth, IP-restricted access, Docker-native deployment, full audit trails — same perpetual-license philosophy as Sentinel Radar. Not yet available — we’re focused on shipping Sentinel Radar first. Drop your email below to get notified at launch.
Everything you need to know
We believe in being upfront. Here's the who, what, where, when, why, and how of Sentinel Vault.
Sentinel Vault is built by Sh-Epic, LLC — a software company focused on practical, security-first tools for engineers and infrastructure teams. The product grew out of real-world frustration: existing secrets managers are either too complex and expensive for smaller teams, or require handing your secrets to a third-party cloud provider. Sentinel Vault was built to fill that gap — a self-hosted vault that is simple to operate, genuinely secure, and doesn't require an enterprise budget.
Sentinel Vault is a lightweight, high-security secrets vault with a REST API and CLI tool. It stores passwords, SSH keys, certificates, API tokens, and any other sensitive data — encrypted at rest with AES-256-GCM.
Access is controlled by token-based authentication combined with an IP allow-list, so only the machines you explicitly trust can reach the vault. Every read and write is recorded in a full audit trail. It runs entirely on your own infrastructure — nothing goes to the cloud.
Sentinel Vault is available as a self-hosted deployment. The FREE edition requires no license key and no account — download, configure, and run. Licensed editions are available directly from Sh-Epic.
GitHub Repo — Coming Soon
You can use it today. The FREE tier requires no license key and supports up to 10 secrets — full AES-256-GCM encryption and all core features included. The Licensed tier unlocks 100,000+ secrets, optional SaaS deployment, a browser-based web UI, and priority support.
Most teams either over-engineer secrets management with heavy enterprise tools, or under-engineer it by storing credentials in environment files, spreadsheets, or chat messages. Neither is acceptable.
Sentinel Vault was built to offer a practical middle ground: genuinely strong security (AES-256-GCM, token auth, IP restrictions, audit logging) in a package that a single engineer can stand up in minutes and maintain without a dedicated security team.
Clone the repo, copy .env.example to .env, generate your encryption keys, and start the server:
git clone <repo-url> && cd sentinelvault
cp .env.example .env
# Add generated AES-256 keys to .env
./start.sh
Or use the standalone sentinelctl CLI binary to interact with any running
Sentinel Vault instance — no Python install required.
Full Documentation — Coming Soon
Interested in Sentinel Vault?
Sentinel Vault is on the Sh-Epic roadmap, not yet available. Drop your email and we’ll let you know the moment it launches — or check out Sentinel Radar, our network monitoring product, which is available right now.