---
title: "Secrets Management"
slug: "secrets-management"
updated: 2024-09-17T11:07:10Z
published: 2024-09-17T11:07:10Z
canonical: "help.hyperscience.ai/secrets-management"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.hyperscience.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Management

*Secrets managers* offer centralized control, storage, and management of API keys, passwords, certificates, and any other sensitive information. Hyperscience’s secrets-management integration allows System Admins to take advantage of the following features:

- Policy enforcement
- Role-based access control
- Auditing of secrets
- Reducing the need to store sensitive data on disk

## Supported secrets-management integrations

Hyperscience offers the following integrations:

- For v32 and later:
  - [AWS Secrets Manager](/deployment/docs/aws-secrets-manager)
  - [CyberArk Conjur](/deployment/docs/cyberark-conjur) (v5.0 and later)
  - [HashiCorp Vault](/deployment/docs/hashicorp-vault)
- For v35.0.6 and later:
  - [One Identity Safeguard](/deployment/docs/one-identity-safeguard)

## Limitations and validations

- Secrets managers are available only for on-premise or private cloud deployments of Hyperscience.
- The secrets-management integration is optional. You can continue storing all of your credentials in the “.env” file or store only some of your credentials in the secrets manager.
- You can store only system-level credentials in the secrets manager.
- You can’t store the credentials for any integrations that are configured within the Hyperscience application, such as credentials for API endpoints, message queues, and other connectors. You need to store these integrations’ credentials in the Hyperscience application.
- The Hyperscience application starts only if all system-level credentials are successfully fetched from the secrets manager. Our integration has validations that prevent the application from starting if the secrets manager is incorrectly configured.
- To maximize the benefits of using a secrets manager, we recommend following the guidelines outlined in [Best Practices for Using a Secrets Manager](/deployment/docs/best-practices-for-using-a-secrets-manager).

## Secrets Managers and SaaS deployments

The Hyperscience cloud services use Kubernetes to execute their workloads. Hashicorp Vault has its own sidecar container, able to inject secrets inside pod volumes based on annotations. To create a bridge between both, we use *ExtrernalSecrets* custom resource definition to generate native Kubernetes secrets.

## Next Steps

Learn how to configure your secrets manager integration in the following articles:

- [AWS Secrets Manager](https://docs.google.com/document/d/1X1igwfS4znN1p8MlLI-911DHlVrcPLeC56wVt01fvNA/edit#heading=h.au7w14f7fhyy)
- [CyberArk Conjur](https://docs.google.com/document/d/1nzJrVQ_cfdzou9Lfympvhw1iFb-GithRuppkG1GIv6g/edit#heading=h.l9bsv6831qrx)
- [HashiCorp Vault](https://docs.google.com/document/d/1BZqGy_DHjnlBum6My2693qulsc0snQeWzeULIXi_0KE/edit#heading=h.i429km0ghhl)
- [One Identity Safeguard](https://docs.google.com/document/d/1f9PQkbH-l5YP7_sCHSqAiARGyf93KetwnLGbuPJPTOk/edit)