Projects are the highest-level organizational unit in Secryn. They define ownership boundaries, group related vaults together, and determine which users can access the resources within them.

A project typically represents an application, environment, team, or customer. All vaults, secrets, keys, and certificates belong to a project, and access to those resources is always evaluated in the context of the project.

Purpose of Projects

Projects serve several important roles in Secryn:

• define the primary access boundary for users
• group related vaults under a common context
• simplify permission management by applying roles at the project level
• provide long-term isolation between unrelated workloads
• preserve historical integrity for audit and compliance purposes

Users must be added to a project before they can interact with its vaults or resources.

Project Ownership and Roles

Each project has users assigned with specific roles such as Admin, Project Manager, Contributor, or Read-only. Roles determine what actions a user can perform within the project, including managing vaults, creating resources, or viewing data.

Administrators have full access across all projects, while other roles are scoped only to the projects they are explicitly added to.

Projects and Vaults

A project can contain one or more vaults. Vaults are used to further organize and secure secrets, keys, and certificates within a project.

By default, project members can access all vaults in a project unless a vault is marked as restricted. Restricted vaults require explicit user assignment, even for users who already belong to the project.

Project-Level Access Evaluation

Access to resources in Secryn is evaluated in the following order:

1. user membership in the project
2. user role within the project
3. vault restrictions (if enabled)
4. resource visibility (for public keys and certificates)

This layered model ensures predictable and secure access behavior.

Project Lifecycle

Projects in Secryn are permanent and cannot be deleted. This design choice ensures:

• long-term audit trail integrity
• consistent historical references in logs and backups
• prevention of accidental data loss
• stronger security and compliance guarantees

If a project is no longer actively used, access can be restricted by removing users, disabling vault access, or archiving resources within the project—without removing the project itself.

Projects form the foundation of Secryn’s access model. Once a project is created, you can safely build vaults and manage sensitive data with confidence, knowing that project boundaries remain stable and auditable over time.