Every key in the company, accounted for.
Relayhaus runs access to your shared logins, vaults and API keys. People ask, the right person approves, access is granted and recorded, and it is taken back when they leave.
Shared access grows quietly
- Logins travel through chats and emails, and nobody can say who still has them.
- Someone leaves, and the list of passwords to change is a guess.
- One API key gets copied into every system that needs it, so changing it breaks them all.
How it works
Ask
People ask in the chat tool they already use. They pick the system or login by name; nobody needs to know which vault it lives in.
Approve
The request goes to the person named for that vault. Nobody approves their own access, and every decision is kept.
Grant
Access is shared from your own password manager, automatically. Nobody sends a password to anyone.
Record and return
Every grant lands in one register. Temporary access ends on its date, and a leaver loses everything in one step.
One provider key. Many systems.
Many providers give each account a single API key, so every system that needs it gets a copy, and every copy is the same key.
With Relayhaus, your systems call the relay instead. Each one gets its own token, limited to the actions it needs and the addresses it calls from. The real key stays in your vault.
- Someone leaves who saw a token: replace that one token. Nothing else changes.
- The provider key itself changes: update it once, in one place.
- A call nobody allowed is refused before it reaches the provider, and you hear about it.
What it covers
- One access register
- A single, current list of who can open what. It keeps itself up to date and exports for audits.
- Access nobody asked for
- Access given outside the process is spotted and flagged, so it can be recorded or removed the same day.
- Leaver checklists
- Built from what the person could actually see, with deadlines that follow how sensitive each login is.
- Rotate once, done everywhere
- Change a credential once and every open checklist that lists it is ticked off.
- Approvals that hold up
- Named approvers per vault, four eyes on every grant, and a full history of who decided what.
- Evidence on request
- Every request, decision and change is logged. Backups are encrypted to keys only you hold.
Works with what you already use
Keep your password manager and your providers. Relayhaus connects to them and manages who can reach what.
Password managers and vaults
- 1Password
- Bitwarden
- NordPass
- Keeper
- Dashlane
- LastPass
- Passbolt
- RoboForm
- Zoho Vault
- Enpass
- Psono
- Passwork
- HashiCorp Vault
- AWS Secrets Manager
- Azure Key Vault
- Google Secret Manager
- Doppler
- Infisical
- Akeyless
- Delinea Secret Server
Provider APIs through the relay 30+
Domains and DNS
- GoDaddy
- Porkbun
- Gandi
- Dynadot
- OVHcloud
- Amazon Route 53
- Google Cloud DNS
- Azure DNS
Hosting and delivery
- DigitalOcean
- Akamai
- Vultr
- Fastly
- Bunny.net
- Vercel
- Render
- Fly.io
- Heroku
Email and messaging
- SendGrid
- Postmark
- Amazon SES
- Mailchimp
- Resend
- Twilio
Business and engineering
- Stripe
- Shopify
- Sentry
- Datadog
- PagerDuty
- GitLab
- Bitbucket
And the rest: if it has a vault or an API, we can connect it. Ask us about yours.
Quiet by design
- Your secrets stay in your vaults
- Relayhaus manages who can reach them. It does not keep a copy of your passwords.
- Keys are used, never shown
- Provider keys are used at the moment they are needed and are never displayed or written to logs.
- Few people, strong sign-in
- Only the people who run access use the admin side, with two-factor sign-in and limits on where it can be reached from.
- Built to be dull
- Small, single-purpose and closed by default. We prefer to tell you how it works on a call rather than on a web page.
Made for groups with many keys
Companies with many entities, brands or websites. Agencies that hold logins for their clients. Any team where people come and go and the same logins are shared between them.
Questions
Do you store our passwords?
No. Passwords stay in your password manager. Relayhaus decides who gets access to which vault and records it.
Which password manager do we need?
The one you already have. The common ones are listed on this page; if yours is not, ask us.
Do our people need another login?
No. They ask in chat and accept the invite in their password manager. Only the people who run access use the admin side.
What happens when someone leaves?
One action removes them from every vault in the register and starts a checklist of what to change, built from what they could see, with deadlines.
What does it cost?
It depends on the size of your setup. Tell us roughly how many people, vaults and systems you have, and we will send a proposal.
How do we start?
A short call to map your vaults, people and systems. We set it up with you and move access over in stages, so nothing stops working.