Organisations
Shared organisational vaults and membership flows sit on the sync API while item ciphertext remains client-encrypted.
Business
PassStash is built first for Trucell operations and the commercial clients that need the same zero-knowledge posture.
AU region residency
The first production region runs on Equinix SY3. Clients discover region
details from /api/v1/server/config on the API origin.
MSP-friendly rollout
Access is contact-led today so onboarding, identity sources, and device policy can be shaped per customer before public self-serve signup.
Operational custody
Peppers, JWT material, and data-protection certificates are generate-once secrets with documented custody — never recovered from a database dump.
Replacing Keeper Vault
PassStash is the owned replacement path for Keeper inside Trucell and for customers who want the same class of vault with clearer data-plane control.
Migration tooling and client importers are on the roadmap; early deployments focus on greenfield org vaults and parallel run.