Introduction

Secryn is a fully self-hosted secret, key, and certificate management platform designed for teams that want complete control over their sensitive data. It provides a secure, centralized way to store, retrieve, version, and manage credentials, cryptographic material, and configuration values across projects and environments—without relying on third-party cloud services.

Secryn is built with a strong security foundation, a simple information model, and a modern UI, making it easy for teams of all sizes to manage sensitive resources with confidence.

What Secryn Does

Secryn helps you:

• store and organize secrets, keys, and certificates in isolated vaults
• group vaults under projects to match your systems or organization
• control access using role-based permissions and restricted vaults
• retrieve items programmatically using a vault-scoped access key
• track changes with full version history and restore points
• automate expiration reminders and digest notifications
• integrate with external systems or AI agents through the API or MCP server
• self-host all data on your infrastructure

The goal is a simple, predictable workflow for security-sensitive teams without the operational overhead of heavy enterprise tools.

Core Concepts

Before installing or using Secryn, understand these primary components:

• Projects – logical groupings containing vaults and their associated users.
• Vaults – containers for secrets, keys, and certificates. Each vault has its own access key for API access.
• Restricted Vaults – vaults that limit access to explicitly added users, even if they belong to the parent project.
• Secrets – secure values such as API keys, tokens, or configuration strings, fully versioned with history.
• Keys – RSA or EC key pairs used for signing, encryption, and cryptographic operations.
• Certificates – uploaded or self-signed certificates with expiration tracking and optional public URLs.
• Users & Roles – access is controlled through project membership and roles (Admin, Project Manager, Contributor, Read-Only).
• API Access – every vault exposes API endpoints that allow fetching secrets, keys, and certificates using a vault access key.
• MCP Server – an optional integration layer enabling AI agents to securely retrieve data from Secryn.

How Secryn Is Deployed

Secryn is fully self-hosted and can run on:

• Docker
• Spin Pro (Server-side up)
• Bare-metal Linux servers
• Any environment that supports PHP, MySQL/PostgreSQL equivalents, and Redis

No data leaves your infrastructure.

The built-in Installation Wizard guides you through:

• environment configuration
• database setup
• SMTP setup
• admin user creation
• optional MCP server initialization
• system checks and first-run tasks

Who Secryn Is For

Secryn is ideal for:

• teams managing sensitive credentials or cryptographic material
• organizations requiring full data ownership
• self-hosted or air-gapped deployments
• developers who need predictable APIs and strong RBAC
• teams replacing spreadsheets, environment files, or ad-hoc secret stores
• infrastructure engineers needing a lightweight but robust vault solution

What's Next

Continue to the next section to install and configure Secryn:

• Installation
• Setup Wizard
• First Steps