TigerTrust Secrets Manager (SM) is a HashiCorp-Vault-compatible engine that runs inside the platform. If you already speak Vault (vault kv get, vault write, vault agent, vault token create, AppRole, JWT, K8s auth), everything here works the same way — pointed at TigerTrust’s /v1/* compat surface.

​
What SM does

  • KV v1 / v2: static key-value secrets with versioning, soft delete, and TTL.
  • Transit: encrypt-as-a-service. Named keys, key rotation, convergent encryption, sign/verify.
  • PKI: issue X.509 leaf certs from a workspace-scoped issuer (integrates with CLM’s PKI Core).
  • Database: dynamic credentials for Postgres, MySQL, Mongo, MSSQL, Snowflake, Redis, Cassandra, Elasticsearch.
  • Wrapping: single-use response wrapping for secret hand-off across trust boundaries.
  • Leases: every dynamic secret has a lease with renewable TTL; expiring leases trigger revocation.
  • Audit devices: signed audit stream to file, syslog, or the platform’s audit log.

​
Architecture

SM’s server side lives inside the TigerTrust backend — no separate server binary to deploy. Clients talk to it directly: 
    CLIENT                                    TIGERTRUST BACKEND
    ┌──────────────┐    HTTPS / v1/*        ┌─────────────────────┐
    │ tt secrets   │──────────────────────► │  SM engine mount    │
    │ vault CLI    │                        │    - kv             │
    │ tt-secrets-  │◄──── leased data ──────│    - transit        │
    │   agent      │                        │    - pki            │
    │ your app     │                        │    - database       │
    └──────────────┘                        │    - wrapping       │
                                            └─────────────────────┘
                                                     │
                                            audit devices, policies,
                                            grants, rotation

Install Secrets Manager

Install the tt CLI, use existing Vault tooling, or deploy the SM agent.

​
Core concepts

Engines

Enable KV / transit / PKI / database mounts and configure their per-mount options.

Secrets

Read, write, list, and version secrets. KV vs dynamic vs wrapped.

Rotation

Scheduled rotation for KV values and database roles. Signed rotation attestations.

Policies

Vault-syntax HCL policies scoped to the workspace, mapped from roles.

Access methods

OIDC / JWT / AppRole / Kubernetes / cloud IAM — pick per client kind.

Sharing

Wrapped one-time-use hand-offs and cross-workspace grants.

​
How SM interacts with other modules

  • CLM consumes SM’s PKI engine as an external issuer (or vice versa — SM can chain to PKI Core).
  • PAM encrypts session recordings via SM’s transit engine before they hit S3.
  • NHIG enumerates every SM AppRole and issued client-token as a machine identity.

​
Where to start

Install and log in

Get the tt CLI, log in, and issue your first token.

First KV secret

Write, read, and version a static secret.

Dynamic DB credentials

Turn a static DB password into short-lived per-request credentials.

Rotation policies

Automate KV and DB rotation on a schedule.