Keyorix

Spec sheet

Purpose

Keyorix is a secrets, keys, and certificates management platform designed for teams that cannot use SaaS.Read 11 Oct 2026 · github.com

Product

Keyorix describes itself as open-source secrets management for teams that cannot use SaaS.Read 11 Oct 2026 · github.com

Intended users

The repository describes Keyorix as lightweight on-premise secrets management for European enterprises.Read 11 Oct 2026 · github.com

Deployment

The project describes itself as on-premise, air-gap ready, and available as a single binary.Read 11 Oct 2026 · github.com

Integrations

The maker lists Go, Python, Node.js, and Java SDKs and an MCP server with read-only secret tools.Read 11 Oct 2026 · github.com

Security

The maker says access actions use cryptographic proofs and zero-knowledge protocols, and that interactions can be verified without exposing sensitive data.Read 11 Oct 2026 · keyorix.com

Privacy

The privacy policy says the software is self-hosted, sends no telemetry or license-check calls, and keeps secrets and data in the user's infrastructure.Read 11 Oct 2026 · keyorix.com

Compliance

The maker describes Keyorix as aligned with NIS2 and DORA requirements.Read 11 Oct 2026 · github.com

Support

The terms say paid services such as support are governed by a separate written agreement.Read 11 Oct 2026 · keyorix.com

Headquarters

Valencia, SpainRead 28 Sep 2026 · keyorix.com

Access control

The repository lists role-based and group-based permissions, service tokens for CI/CD, and dynamic secrets with time-to-live.Read 11 Oct 2026 · github.com

Air-gapped use

The repository says the core product needs no internet access and supports air-gapped deployment.Read 11 Oct 2026 · github.com

Audit

Keyorix says it logs who accessed what, when, and from where, and provides dashboard alerts for secrets nearing rotation deadlines.Read 11 Oct 2026 · github.com

Encryption

The repository says secret values are encrypted with AES-256-GCM and that secrets are not logged or exposed in error messages.Read 11 Oct 2026 · github.com

Health scan

The maker offers a free, read-only Vault and OpenBao health scan that does not read secret values or send telemetry.Read 11 Oct 2026 · keyorix.com

Interfaces

The product includes a CLI, a web dashboard, and REST and gRPC APIs.Read 11 Oct 2026 · github.com

License and commercial terms

The software is released under AGPL-3.0, and the maker says commercial licenses are available for organizations that cannot use AGPL.Read 11 Oct 2026 · keyorix.com

Migration

The project documents importing from Vault exports and .env files, and provides a separate migration binary for live Vault, OpenBao, and cloud secret managers.Read 11 Oct 2026 · github.com

Privacy policy

The website privacy policy says it collects information submitted through its forms and does not use analytics, advertising, or tracking cookies.Read 11 Oct 2026 · keyorix.com

SDKs

The repository lists Go, Python, Node.js, and Java SDKs.Read 11 Oct 2026 · github.com

Secret handling

Secrets can be injected into applications as environment variables through the CLI.Read 11 Oct 2026 · github.com

Secret management

The product supports creating, reading, updating, deleting, and versioning secrets, with development, staging, and production environments.Read 11 Oct 2026 · github.com

Zero trust

The maker says short-lived credentials and cryptographic proofs continuously verify access across cloud, on-prem, edge, and IoT nodes.Read 11 Oct 2026 · keyorix.com

Where Specifiction places it

• Secrets Management Tools#20 of 467.7