01
It outlives the job
That message is still on the phone of an engineer who left the company eighteen months ago, along with the client's access control admin password.
GX-12 · The Vault
Every technical job runs on a handful of passwords. Panel engineer codes, controller logins, licence keys, camera credentials. Right now yours are in a WhatsApp message, a notes app, or a spreadsheet called passwords.
Argon2id · AES-256-GCM · Encrypted in your browser before it reaches us
The problem
It happens because there is never a better option to hand. The second engineer needs the code, they need it now, and the only tool everyone already has open is the group chat.
01
That message is still on the phone of an engineer who left the company eighteen months ago, along with the client's access control admin password.
02
Six weeks later somebody needs the same code and it is four hundred messages up, between a photo of a sandwich and a delivery note.
03
You are holding credentials to somebody else's security system in a consumer messaging app. That is a conversation you do not want to have.
How it works
You set a Vault passphrase. It derives your key locally using Argon2id at 64 MiB of memory and three iterations, and what reaches our storage is ciphertext and wrapped keys. We hold no master key, no organisation key and no copy of yours.
That is a deliberate design choice rather than a limitation. A credential store that the vendor can read is a credential store that the vendor can be compelled to hand over, or lose.
Shot V1
Vault unlocked, showing stored entries for a project
1600 × 1200
What goes in it
A rough guide to what contractors put in first. Anything you would rather not send in a message.
Panel engineer codes
Fire and intruder panel access levels that every commissioning engineer needs.
Controller logins
Access control and door controller admin credentials.
Camera and VMS credentials
Device passwords and recorder logins across a CCTV estate.
Licence keys
Software and platform licences bought against the project.
Network details
Switch and controller access for the data side of the job.
Client-supplied secrets
Anything the client hands you that should not sit in your inbox.
Be clear about this
Forget your passphrase and an administrator can restore your access using the organisation recovery key, without Graftix being involved at any point. Lose the organisation recovery passphrase as well and the entries are genuinely unrecoverable, by anyone. That is the direct consequence of holding no key, and it is why the recovery passphrase should sit with more than one person in the business.
Further reading
The problem
Most installers use one set of codes across every site they maintain. What that actually exposes, and the one thing that decides whether fixing it sticks.
The build
Every credential store answers one question: who holds the key. Argon2id parameters, per-entry keys, and why the recovery key belongs to you.
Get started
Take the credentials for one live job and put them somewhere they belong. It takes about five minutes.