PAM

Secrets Management

CoreLink encrypts every secret with AES-256-GCM using a unique data encryption key (DEK) per secret. The DEK is then wrapped by a key encryption key (KEK) stored in your KMS provider of choice -- AWS KMS, Azure Key Vault, GCP Cloud KMS, or HashiCorp Vault. Version history tracks every change, and soft-delete with configurable retention keeps secrets recoverable.

Secrets can be organized by workspace and environment, with RBAC controlling who can read, write, or admin each scope. Bulk import via JSON or CSV makes migration from existing tools straightforward.

Secrets Management screenshot

Key Configuration

  • KMS provider selection (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault)
  • Default rotation interval
  • Version retention policy
  • Bulk import format (JSON/CSV)
All documentation Question about this? Talk to us