Team Connection Vault

The Team Connection Vault lets your team share database connection details securely, protected by end-to-end encryption that not even Tablen's servers can read.

What the Vault stores

The Vault holds the connection metadata your team needs to reach a shared database:

• Host
• Port
• Database name
• Username

Passwords are never stored in the Vault.

End-to-end encryption

The Vault is end-to-end encrypted. Before anything leaves your machine, the macOS client encrypts the metadata with AES-256-GCM using a per-team key held in your device Keychain. The server stores only opaque ciphertext and can never decrypt Vault contents. The plaintext never leaves your devices.

Because the stored ciphertext and the wrapped keys are protected only by your team's client-side key, they are independent of the server's application key (APP_KEY). Even the server operator cannot read your values.

How it differs from Shared Connections

Ordinary Shared Connections are encrypted on the server, which means the server can read them. The Vault works differently: it is end-to-end encrypted, so even the server operator cannot read the values.

Requirements

The Vault requires the connection_sharing feature, which is included with a Team plan.

Working with entries

Vault entries are managed through these endpoints. Every payload is opaque to the server: a create sends only a name, the ciphertext, and a nonce, and the server returns them verbatim.

The ciphertext for each entry is capped at 1 MiB.

Access and auditing

Access is scoped to your team. Entries that belong to another team are never visible to you and return 404. Every action on the Vault — creating, reading, updating, or deleting an entry — is recorded in an audit log.