Introduction

Secryn is a fully self-hosted secret, key, and certificate management platform designed for teams that want complete control over their sensitive data. It provides a secure, centralized way to store, retrieve, version, and manage credentials, cryptographic material, and configuration values across projects and environments—without relying on third-party cloud services.

Secret values, secret versions, and audit before/after values are encrypted with Laravel encryption keyed by APP_KEY. Generated and uploaded private keys, and certificate private keys, are stored in a SECRYN-PRIVATE-V1 envelope encrypted with that same APP_KEY. Backup archives use AES-256-GCM. Public links return public material only, never a private key. The security model states these boundaries, including that Secryn has not completed a third-party audit or penetration test.

What Secryn Does

Secryn helps you:

store and organize secrets, keys, and certificates in isolated vaults
group vaults under projects to match your systems or organization
control access using role-based permissions and restricted vaults
retrieve items programmatically using a vault-scoped access key
track secret changes with version history and restore a previous secret version
automate expiration reminders and digest notifications
integrate with external systems or AI agents through the API or MCP server
self-host all data on your infrastructure

The goal is a simple, predictable workflow for security-sensitive teams without the operational overhead of heavy enterprise tools.

Core Concepts

Before installing or using Secryn, understand these primary components:

Projects – logical groupings containing vaults and their associated users.
Vaults – containers for secrets, keys, and certificates. Each vault has its own access key for API access.
Restricted Vaults – vaults that limit access to explicitly added users, even if they belong to the parent project.
Secrets – values such as API keys, tokens, or configuration strings. Values and versions are encrypted with Laravel encryption keyed by APP_KEY.
Keys – RSA, EC, or Ed25519 key pairs. Private keys are stored in a SECRYN-PRIVATE-V1 envelope encrypted with APP_KEY. A public link returns the public key only.
Certificates – uploaded or self-signed certificates with expiration tracking. Certificate private keys use the same SECRYN-PRIVATE-V1 envelope. A public link returns the certificate only.
Users & Roles – access is controlled through project membership and roles (Admin, Project Manager, Contributor, Read-Only).
API Access – each vault has one read-only access key, sent as Authorization: Bearer. The key is not role-based and is not a project-wide credential.
MCP Server – an integration that checks one shared instance session id and receives the vault access key inside the tool call.

How Secryn Is Deployed

Secryn is fully self-hosted and can run on:

Docker
Spin Pro (Server-side up)
Bare-metal Linux servers
The official install runs MySQL

Secryn does not send vault contents (secrets, keys, or certificates) to Emrys Technologies. Optional bug and feature reports can send non-sensitive metadata to support.secryn.io when you submit them. Mail delivery and Let's Encrypt are outbound calls from your server.

The built-in Installation Wizard guides you through:

environment configuration
database setup
SMTP setup
admin user creation
optional MCP server initialization
system checks and first-run tasks

Who Secryn Is For

Secryn is ideal for:

teams managing sensitive credentials or cryptographic material
organizations requiring full data ownership
self-hosted or air-gapped deployments
developers who need predictable APIs and strong RBAC
teams replacing spreadsheets, environment files, or ad-hoc secret stores
infrastructure engineers needing a lightweight but robust vault solution

What's Next

Continue to the next section to install and configure Secryn:

Installation