Team passwords, encrypted, in the same place as the work.
A team password vault for logins, 2FA codes, SSH keys, API keys and secure notes. Encrypted at rest, members-only, with every reveal and copy logged. AI teammates never see it.
Logins in a spreadsheet, shared in chat, never rotated.
Without TaskCrew
- The “logins” spreadsheet everyone can open
- Passwords pasted into chat, and there forever
- Nobody knows who looked at the root account
- People leave, and the passwords stay the same
With TaskCrew
- Encrypted entries, open only to the people you add
- Reveal or copy, instead of pasting into chat
- Every reveal and copy in the access log
- “Change it” flags passwords seen by someone who has left
Encrypted and members-only.
Secrets are encrypted at rest with AES-256-GCM. A vault opens only to the people its managers add, and asks for your TaskCrew password before it shows a secret.
- Viewer, editor and manager roles for each vault
- Admins can see a vault exists, but see no entries until they add themselves, which everyone in it can see
- A My space vault for logins only you can open
Every reveal and copy, logged.
Each reveal, copy, download and change goes into the vault’s access log, with the person and the time. Access review shows weak, old, exposed and recently revealed passwords, without decrypting anything.
- “Who viewed it” for every entry
- “Change it” when someone who saw a password loses access
- Revealed secrets hide again by themselves, and copied ones are cleared from the clipboard
Built from strength tags, dates and this log. Nothing is decrypted.
Invisible to AI.
Vaults are for people working in the TaskCrew app. AI teammates, the MCP server, API tokens, search and exports never get a secret.
- Search finds a title or a website, never a password
- Vaults can’t be exported, so nothing leaves in bulk
- Mention an entry in a task and people see its title, nothing more
What a team vault needs.
A password generator: random passwords or passphrases
A strength check on every login
2FA codes from a setup key, or a QR code read in your browser
SSH keys, API keys, database logins, secure notes and files like .env
A My space vault for private logins
Members and roles for each vault
Reminders to change old passwords
Link an entry to the wiki page with the steps
Deleted entries go to the vault’s trash first
The one place AI can’t go.
This is enforced by the server, not by a setting someone can forget to turn on.
- AI teammates can still do the work around a login, like a runbook or a handover note
- Every action they take outside TaskCrew can wait for a person to approve it
- Secrets never reach their prompts, their tools or their sandbox
| AI teammates | Every vault tool call from an AI teammate is refused |
|---|---|
| MCP and API tokens | Refused by every vault endpoint, REST or MCP |
| Search and links | Titles and website hosts only, never usernames or secrets |
| Exports | Vaults can’t be exported |
| Tested | A guard test fails if other code reads the encrypted column; an integration test checks the database row, every listing, search, exports, MCP and the AI scope |
Next to the work, but locked.
Wiki pages
Link an entry to the page that explains it, like a runbook or a handover note.
Tasks and comments
Mention an entry in a task. People see its title, and only vault members can open it.
Access review
Owners and admins see vault health across the workspace: weak, old, exposed and recently revealed.
My space
Everyone gets a private space, where a vault holds logins nobody else can open.
One workspace. Everything connects.
Encryption at rest, not end-to-end: the server holds the key. Host TaskCrew yourself to hold it too.
Questions, answered
Is it a 1Password replacement?
Not for everything. It’s for the logins a team shares around its work: the client’s hosting, the domain registrar, the office Wi-Fi, the root account. There is no browser extension and no autofill, so you copy and paste. For everyone’s personal passwords across every website, keep a dedicated password manager.
Is the vault free?
No, the vault isn’t on the Free plan. Team includes 25 vault entries, and Business has an unlimited vault. You can try Business free for 14 days. See pricing.
Can AI teammates see our passwords?
No. Every vault endpoint refuses AI teammates, the MCP server and API tokens, and secrets never appear in search, exports, notifications or task activity.
Can workspace admins read every vault?
No. Admins can see that a vault exists and manage its members, but they see no entries until they add themselves. That shows in the member list, and everything they reveal afterwards is logged. Nobody else can open your My space vault, admins included.
Is it end-to-end encrypted?
No. Secrets are encrypted at rest with AES-256-GCM, which protects a leaked database or backup. The server holds the key, so whoever runs the server could decrypt them. If that matters to you, host TaskCrew yourself and keep the key. Self-hosting.
Move the logins out of the spreadsheet.
Free for up to 5 people. Try Business free for 14 days.