for engineering teams

Stop sharing credentials in Slack. Start governing your stack.

Stack start is the credential governance layer for multi-vendor, agentic development. Per-user keys. Per-service permissions. One-click cascade revoke that fires upstream at every provider in the bundle. The audit trail your security team has been asking for, across every provider at once.

Talk to us →Mint a master key
the problem you're living with

Six dashboards, a shared password manager, and hope.

Right now

Credentials shared in Slack DMs that nobody deletes. Prod database URLs sitting in committed .env files. When someone leaves, an engineer spends an afternoon clicking through six provider dashboards. And then privately hopes they got them all. (They didn't.)

Stack start does

The usual suspects each solve a slice. IAM is one cloud. Doppler holds secrets you already pasted. Vault is an operations team. We do the whole thing: provision the providers, scope the keys, and resolve them per environment, across every vendor your team actually uses.

how the team plumbing works

Three primitives. The fewest you can get away with.

Workspaces own stacks.

Your team is a workspace. The workspace owns the stack's master key. Each member is added with a role (owner, admin, prod engineer, engineer, contractor, or auditor). The master key never leaves the workspace.

workspace mira-lab
owner · mira@…
engineer · jules@…
contractor · sam@… 24h
auditor · sec@…

Every dev mints their own scoped key.

A developer calls POST /keys/derive from the dashboard or CLI. They get an env-scoped key, valid for the role they own. That is their personal credential, never the master.

$ stackstart keys derive --env=dev
 
✓ ss_dev_8c2e…
# scoped: all except clerk
# expires: never · revocable

Policies enforce the rules automatically.

Write a workspace policy: required envs, excluded services, max TTL for contractors, mandatory rotation. Stack start refuses to mint a credential that violates it.

// policy.yml
contractor:
  max_ttl: 24h
  deny: [stripe, clerk]
prod: require_sso: true
when someone leaves

Offboarding takes one click, not an afternoon.

● today · without stack start
# revoke dana, manually:
1. find Neon project, remove
2. Clerk dashboard, remove
3. Resend, Stripe, Sentry…
4. rotate shared keys she saw
5. three months later: you
   missed Sentry.
● with stack start
# revoke dana:
$ stackstart members revoke dana
 
✓ key revoked
✓ access dropped across
   6 providers simultaneously
✓ logged to audit trail
# done. one action.
compliance

The audit log your auditor stops asking about.

01 · structured log

Every event captured.

Who did it, where from, what they touched, when, which workspace. Every resolve and every revoke gets one row. The auditor stops asking for screenshots.

02 · export

CSV and SIEM, one click.

Filter by date, event type, or actor. Stream to your SIEM or hand the auditor a clean CSV in 30 seconds. The PDF-of-a-screenshot era is over.

03 · snapshots

We snapshot before we delete.

Before a key is revoked, we capture exactly what it could access and attach it to the audit event. So when somebody asks "what did Dana have on March 14?", you have the receipt.

how we compare

The intersection nobody else is sitting on.

Provisions resources across providers
  • stack start●
  • Doppler○
  • Vault○
  • AWS IAM◐
Multi-cloud / multi-vendor
  • stack start●
  • Doppler●
  • Vault●
  • AWS IAM○
Per-user scoped derived keys
  • stack start●
  • Doppler◐
  • Vault●
  • AWS IAM●
One-click cross-provider revoke
  • stack start●
  • Doppler○
  • Vault○
  • AWS IAM○
Policy-enforced TTL & scope caps
  • stack start●
  • Doppler○
  • Vault●
  • AWS IAM●
Pre-revocation audit snapshots
  • stack start●
  • Doppler○
  • Vault○
  • AWS IAM○
HPKE end-to-end on resolve
  • stack start●
  • Doppler○
  • Vault○
  • AWS IAM○
what you're about to ask

The questions every VP of Eng asks.

  • “Doesn't this already exist?”
    In slices. IAM governs one cloud. Doppler and Vault store secrets you already created. Heroku hosts apps. None of them provision, govern, and resolve credentials across your full multi-provider stack (Neon, Cloudflare, Clerk, Stripe, Sentry) from one key, per environment. That intersection is the product.
  • “Why would I trust you with our credentials?”
    You own the provider accounts. Resources are provisioned on your Neon and your Cloudflare. Every credential is pgcrypto-encrypted at rest and never logged in plaintext. Resolve responses are end-to-end encrypted to your client via HPKE (RFC 9180), so the bundle is opaque to anything between our server and your agent. See the Security page for the full threat model.
  • “What if you disappear?”
    Your stack keeps running. Because resources live on your own provider accounts, stack start vanishing tomorrow doesn't take your infrastructure with it. Export your raw provider credentials any time. There is no lock-in by design.
  • “Do you support SSO and SAML?”
    Yes. SSO via SAML and OIDC is available on the Enterprise plan, with enforced SSO as a workspace policy. Your prod keys can require an SSO-authenticated session to mint. Team gets the workspace key policies and cascade revoke; SSO sits one tier up.
  • “What about SCIM provisioning?”
    SCIM directory sync is available on Enterprise. Members and roles provision and deprovision automatically from your IdP. When HR offboards someone, their stack start access drops without a manual step.

Make ‘who has the prod key’ a question nobody asks.

Per-user keys, one-click revoke that reaches every provider upstream, an audit your auditor accepts. Twenty minutes, no procurement form, no demo theater.

Talk to us →Mint a key