# TessariDB Vault

> A company password manager its operator cannot read: records are encrypted in each member's browser, and the server keeps only ciphertext in TessariDB.

## Pages

- [TessariDB Vault: a company password manager its operator cannot read](https://vault.tessaridb.com/): A company password manager its operator cannot read: records are encrypted in each member's browser, and the server keeps only ciphertext in TessariDB.
- [What 0.0.1 holds](https://vault.tessaridb.com/features): Records encrypted in the browser, shared with members, teams and departments; recovery the member sees; sign-in by password, OpenID Connect or passkey.
- [Three layers, and the keys at each](https://vault.tessaridb.com/architecture): Where each key lives: sealed in the browser, kept in the company's own TessariDB vault, stored by TessariDB. And the eleven things it does not protect against.
- [Getting started with TessariDB Vault](https://vault.tessaridb.com/start): Start the server and a TessariDB node with one compose file, enrol the platform admin, create the first company and its owner, or run the binary alone.

## Elsewhere

- [Full text](https://vault.tessaridb.com/llms-full.txt): every page of this site as one Markdown document
- [Documentation](https://docs.tessaridb.com/vault): companies and roles, records and sharing, recovery, keys and limits, and the HTTP API, page by page, on docs.tessaridb.com
- [Source](https://github.com/tessaridb/tessaridb-vault): the server's repository, Business Source License 1.1
- [Image](https://hub.docker.com/r/tessaridb/vault): `tessaridb/vault:0.0.1` on Docker Hub
- [TessariDB](https://tessaridb.com): the database that holds every piece of the server's state; 0.39.3 or later
- [TessariDB S3](https://s3.tessaridb.com): its documentation is at https://docs.tessaridb.com/s3
- [TessariKV](https://kv.tessaridb.com): its documentation is at https://docs.tessaridb.com/kv
- [TessariDB Agent Memory](https://am.tessaridb.com): its documentation is at https://docs.tessaridb.com/am
- [TessariDB OAuth](https://oauth.tessaridb.com): its documentation is at https://docs.tessaridb.com/oauth

## Status

Version 0.0.1. Before 1.0 the configuration and the HTTP surface may still change in a minor release. Runs on TessariDB 0.39.3 or later.

## What it does not protect against

The full list of eleven is at https://vault.tessaridb.com/architecture#limits. Among them: an unlocked browser and the device it runs on; the code the server delivers; your company's owners and admins; metadata: who shares what with whom, sizes, counts and times.