First-party clients
The Password Manager browser extension and Dayrook mobile app include code to sync encrypted vault items, collections, grants, TOTP, secure sends, and policy state through the same Digital Vault APIs.
Digital Vault & Password Manager
The right credential. The right access.
Keep client credentials scoped, encrypted and available through deliberate access and recovery paths.
Digital vault and password manager
Credential access with explicit trust and recovery boundariesScoped vault viewValues masked
Administrative login
Step-up•••• •••• ••••
Network appliance
Scoped•••• •••• ••••
Cloud service
Scoped•••• •••• ••••
Access decision
- Role
- Technician
- Scope
- Selected client
- Action
- Remote session
Role matchedMFA requiredApproval pending
Decision not executedEvery access has a boundary
Useful access. Explicit control.
Keep encrypted items, collections, policies, grants, trusted devices, TOTP, and audit connected.
Illustrative workflow · explore the steps · no action is executed
01
Encrypt before upload
Create item content and attachments through the client-side encryption boundary.
Confirm this step for your release, permissions and environment.02
Grant scoped use
Share wrapped keys through collections, roles, devices, expiration, and policy.
Confirm this step for your release, permissions and environment.03
Use and audit
Reveal, autofill, inject, send, export, or recover only through the required trust gates.
Confirm this step for your release, permissions and environment.Make secrets usable without making plaintext casually available.
Use browser and mobile access without exposing raw secret values to unrelated workflows or telemetry.
Inside the workflow
The work this connects.
- Multiple item types
- Support logins, secure notes, identities, cards, TOTP, SSH references, and encrypted attachments.
- Collections and sharing
- Grant team, group, device, guest, and customer-aware access without distributing plaintext.
- Secure Send
- Create encrypted, expiring, revocable shares with download limits and access evidence.
- Browser extension
- Use domain-aware autofill, autosave, generation, TOTP, secure send, and controlled offline cache.
- Mobile access
- Unlock an encrypted mobile cache through approved session and biometric policy.
- Health and policy
- Review weak, reused, aged, or known-compromised credentials without logging secret values.
Try one useful scenario
Credential custody and revocation
Fictional example: revoke a user while their client is offline, then attempt access before and after reconnecting. Test the approved offline expiry and confirm which cached items remain accessible.
Illustrative evaluation scenario, not a recorded product result.What a useful result must show
Record who can decrypt each credential class, recovery authority, local expiry, domain-match result and the observed revocation boundary. Inspect what leaves the client for breach checks.
Get the evaluation worksheet →Check the support boundaries
- End-user encrypted vault items
- Automation credentials authorized for execution
- Recovery and offline access
- Browser domain matching, biometric fallback and push privacy
The mobile app and browser extension are planned surfaces; signed distribution and a tested release are not evidenced here. A zero-knowledge claim for user vault items must not be generalized to automation credentials an executor is authorized to decrypt.
Check public evidence and availability →Scope, availability and evaluation details
Zero-knowledge controls constrain server-side recovery and prohibit plaintext server import for protected item material.
Reveal, export, offline access, and emergency recovery follow role, MFA, device, and policy controls.
The proposed $99 monthly model includes the target product scope for evaluation, unlimited technicians, unlimited customers, and the first 50 managed devices. Final terms require confirmation. See transparent pricing →
Review full environment and integration scope
Migration without a runtime dependency
Purpose-built import and export workers can move approved records into the Digital Vault & Password Manager while the live control plane remains first-party and credential material stays encrypted.
Provider and migration credentials are stored as purpose-bound Vault or KMS references; operational modules receive authorization, not unrestricted plaintext.
Questions, answered
Before you choose your next step.
Can Dayrook administrators read every stored password?
The target design encrypts end-user vault items under user-controlled keys. Validate who can decrypt them, including any configured recovery path, in the evaluated release. Automation credentials have a separate authorized-executor custody model; do not assume the same zero-knowledge boundary.
Does the Password Manager support TOTP?
Target design: TOTP seed storage and code generation are supported within the encrypted item and trusted-device model.
Can credentials be shared outside the team?
Secure Send and approved guest access can provide time- or access-limited sharing with revocation and evidence.
What happens during billing suspension?
Digital Vault behavior follows the conservative read-only and export policy; new writes and shares are blocked while permitted recovery access remains governed.