Everyone has secrets.Protect yours with a Burrow.
Application secrets, short-lived credentials and certificates,
in one secrets manager on your own infrastructure in minutes.
Download the Burrow
Linux
macOS
Windows
Docker
| Event | When |
|---|---|
| ci-runner-8d2e was issued login 'rk_8d2e91aa_a42d09e1_q4mz' by dynamic secret 'DATABASE' in 'billing-api/prod' | |
| Node 'web-01' carried out 'ssh.trust': nothing needed changingRatel Node 0.4.1 | |
| api-prod-1 read secret 'STRIPE' in 'billing-api/prod'Python SDK 1.0.1 | |
| Machine 'old-worker' was disabled after reading canary 'AWS_ROOT_KEY' in 'billing-api/prod' | |
| jack attached certificate authority 'prod-ssh' to node 'db-01' |
Created Sep 28, 10:14 by jack
| Machine | Username | State | Ends |
|---|---|---|---|
| rk_3fa91c7b_a42d09e1_x7k2 | Active | ||
| rk_5d8e20f4_a42d09e1_t6qn | Active | ||
| rk_e41b6a02_a42d09e1_k9sd | Active | ||
| rk_9c04e2d1_a42d09e1_m3pz | Active | ||
| rk_8d2e91aa_a42d09e1_q4mz | Active | ||
| rk_c2a9e7b1_a42d09e1_p1vy | Active | ||
| rk_71be03c9_a42d09e1_d8wr | Revoking |
| Secret | Value | |
|---|---|---|
| DATABASEPostgreSQL · 7 logins | •••••••••••• | |
| DEPLOY_SSHSSH user · prod-ssh | •••••••••••• | |
| STRIPE3 fields | •••••••••••• | |
| JWT_SIGNING_KEYHex | •••••••••••• | |
| REDIS_URLURL | •••••••••••• | |
| SENDGRID_API_KEYToken | •••••••••••• | |
| AWS_ROOT_KEY · tripped x1 | •••••••••••• |
Secrets Management
Every secret in its project and environment, versioned.
A secret can also issue each machine its own login, rotate an account's password, or disable the machine that reads it.
| Secret | Value | Version | Updated | |
|---|---|---|---|---|
| SENDGRID_API_KEYToken | •••••••••••• | |||
| STRIPE3 fields | •••••••••••• | |||
| AWS_ROOT_KEY · tripped x1 | •••••••••••• | |||
| DATABASEPostgreSQL · 7 logins | •••••••••••• | |||
| BACKUP_PASSWORDWindows account · FS-01\backup | •••••••••••• |
Machine Identity
Every server, container and pipeline signs in as a machine of its own.
A server keeps a key it generated itself, and a CI job uses a token its platform issues for each run.
A short-lived runner stops working when its lifetime ends.
| Machine | Status | Key | Last seen | |
|---|---|---|---|---|
| api-prod-1 | Enabled | |||
| github-release | Enabled | |||
| gitlab-deploy | Enabled | |||
| bitbucket-build | Enabled | |||
| ci-runner-8d2eExpires in 54m | Enabled |
Certificate Authorities
Your Burrow runs its own certificate authorities, and their signing keys stay inside it.
Each host trusts the ones you attach through its node, and a new key is trusted before it signs anything.
| Certificate authority | Signing key | Rotation | Created | |
|---|---|---|---|---|
prod-sshSSH user1 secret | ||||
staging-sshSSH user1 secret | ||||
ci-sshSSH user2 secrets | ||||
bastion-sshSSH user | ||||
legacy-sshSSH userDisabled |
Audit Logs
Your Burrow records everything that happens in it, and everything it does on its own.
Each event is graded by severity and can be sent to a webhook the moment it happens.
| Event | Source | When |
|---|---|---|
| ci-runner-8d2e was issued login 'rk_8d2e91aa_a42d09e1_q4mz' by dynamic secret 'DATABASE' in 'billing-api/prod'CLI 0.1.0 | ||
| api-prod-1 read secret 'STRIPE' in 'billing-api/prod'Python SDK 1.0.1 | ||
| Machine 'old-worker' was disabled after reading canary 'AWS_ROOT_KEY' in 'billing-api/prod'CLI 0.1.0 | ||
| Machine 'old-worker' read canary 'AWS_ROOT_KEY' in 'billing-api/prod'CLI 0.1.0 | ||
| jack attached certificate authority 'prod-ssh' to node 'db-01' |
RatelKey
Everything around your Burrow that you'd otherwise have to run yourself. RatelKey is a full identity provider for your team, with two-factor, passkeys and OAuth sign-in, and single sign-on and directory provisioning with your own identity provider. It decides which people get in; your machines never depend on it.
Burrow
Everything RatelKey is built around, running on infrastructure you own. It serves your secrets to servers, containers and pipelines, gives each machine a login of its own that ends on time, signs certificates your servers trust, and records every read and change. Machines never go through RatelKey.