Secrets and Configuration Vault
Every key. Every environment. Always controlled.
Ledger is one governed store for configuration values, secrets and certificates, organized in folders that mirror your environments and inherit down them. Other products reference a secret by name instead of copying it, so one rotation updates every place that uses it, and every secret read is logged. It also publishes values to external secret stores and serves workloads running outside Neuraforge.
Secrets copied into scripts and connection settings are hard to find and harder to rotate. Ledger keeps configuration values, secrets, and certificates in one governed store organized like your environments. Other products reference them by name, so one rotation updates every consumer, and every secret read is logged.
- Folders that mirror your environments, with inheritance and locks that stop child overrides
- Public, private, and secret tiers, with secrets encrypted under per-organization keys, including your own
- Values that reference other values, resolved safely after inheritance
- Access decided by the platform's own permission engine, with no separate model to maintain
- Version history, rotation reminders, and sync to external secret stores such as GitHub Actions
What you get
What Ledger gives your team.
Three sensitivity tiers
Public, private and secret values live in one store, each with its own visibility and audit posture.
Folders with locked inheritance
Closest-match-wins inheritance down the folder tree, plus a lock that stops descendant folders overriding a value.
Reference by name, rotate once
Other values and product credential fields point at a secret by name, so one rotation updates every consumer.
Version history and recovery
Masked version history with audited reveal, revert, rollback, environment checkpoints and a recycle bin.
Publish to external stores
Push only changed values to GitHub Actions, Vercel, AWS SSM Parameter Store, Kubernetes and Azure Key Vault.
Just-in-time secret access
Grant time-boxed, self-expiring access with a required justification and a separate approver instead of standing permission.
How it works
- 1
Lay out environment folders
Create folders that mirror your environments. Values inherit closest-match-wins down the tree, and a lock stops descendant folders overriding a value.
- 2
Add values by sensitivity
Import .env or JSON files or create parameters one by one. Pick public, private or secret; credential-shaped keys default to secret.
- 3
Reference secrets by name
Point script, connection and notification credential fields at a secret by name instead of pasting it, so one rotation updates every consumer.
- 4
Rotate, publish, review
Rotate with generated values, publish changed values to external secret stores, and review the Access Log and posture dashboard for dormant or expiring items.
Ask AI about Ledger
Every Ledger page has an Ask AI button. It opens a chat that already has the page, its rows, and your selection. Try asking:
- Which parameters on this page are marked secret, and which have the oldest last-changed date?
- How do I reference a secret from another value? Show me the documentation link.
- Which folders on this page are locked against child overrides?
How teams use it
- Replace credentials copied across scripts and connections with one rotatable source.
- Promote configuration from staging to production without revealing secrets.
- Feed a Kubernetes cluster or CI pipeline from the same governed store.
Frequently asked questions
See Ledger in action
Join the early-access list, or talk to our team about your environment.
Talk to us