This guide walks you through purchasing, installing, and configuring Secryn on your own server.
Secryn is distributed via Self-Host Pro and installed using a secure, time-limited installation script.
Visit the Secryn pricing page and purchase a license. Secryn is $99 USD/year per organization, covering one production environment plus one staging or test environment, with no cap on users, vaults, or resource counts. A refund is available for 7 days after purchase.
The annual subscription includes updates and standard email support during the active paid term. Annual renewal buys continuing updates and support. You can cancel at any time; updates and standard email support continue until the paid term ends, then end if you do not renew. You can keep using your licensed installed version forever, subject to the license terms.
The install includes the Secryn application source so you can run it on your server. Secryn is proprietary software, not an open-source product. The CLI is a separate open-source project.
After checkout, you will be redirected to the post-purchase flow.
Open your email and look for a message from Self-Host Pro related to Secryn.
Click Install Secryn in that email to open the Self-Host Pro portal.
In My Products, you will see Secryn listed under purchased products.
If prompted, enter your email to receive a sign-in link and access the portal.
Your server must meet the following minimum requirements:
If using a domain (recommended), point your DNS A record to the server's public IP before installation.
In Self-Host Pro -> My Products -> Secryn, copy your generated installation command.
SSH into your server as root:
ssh root@yourdomain
Paste and run the installation script.
During installation, the script will prompt you to enter your Application URL.
If you have a domain ready, enter:
https://vault.yourdomain.com
If you do not have a domain yet, you may temporarily use the detected server IP (not recommended for production use).
The application URL is used for:
During installation, the setup process will automatically open configuration files for editing in the nano editor.
You must update the values when prompted.
These steps are mandatory.
When prompted, the installer will open:
/srv/secryn/.env
Update the following values:
DB_USERNAME=your_secure_username
DB_PASSWORD=your_secure_password
After making changes in nano:
CTRL + XYEnterImportant:
The installer will then open:
/srv/secryn/traefik.yml
At the bottom of the file, update the Let's Encrypt email:
email: [email protected]
This email must be valid.
If not configured correctly:
After updating:
CTRL + XYEnterOnce both files are saved, the installation will continue and services will start.
Secryn is installed under:
/srv/secryn
This directory contains:
Once installation completes, the script will display:
Secryn is now running at:
https://yourdomain.com
Open this URL in your browser.
You will be taken to the Setup Wizard.
Inside Secryn, complete the Setup Wizard steps:
When you click Finalize, you will be redirected to the Login page.
Public registration is automatically disabled after installation.
traefik.yml is valid.Regenerate the script from:
Self-Host Pro -> My Products -> Secryn -> Regenerate Installation Script
To inspect logs:
cd /srv/secryn
docker compose logs
Secret values, secret versions, and audit before/after values are encrypted with Laravel encryption keyed by APP_KEY. Private keys and certificate private keys are stored in a SECRYN-PRIVATE-V1 envelope encrypted with that same key. Backup archives use AES-256-GCM. Public links return public material only. Details are in the security model. Secryn has not completed a third-party audit or penetration test.
Existing installs encrypt older plaintext private-key files after upgrading. Copy APP_KEY first, preview with php artisan vault:encrypt-private-material --dry-run, then run the command. Steps are in Updating Secryn.
.env or traefik.yml. APP_KEY decrypts secret values and private-key envelopes, and it is the HMAC key for access-key hashes. If it is lost, those private keys cannot be recovered.APP_KEY can decrypt them. Files that have not yet been through vault:encrypt-private-material are still plaintext.Authorization: Bearer.