Request client credentials securely, instead of emailing passwords around
Erseni Vault is the GDPR-compliant, EU-hosted zero-knowledge tool for agencies: you send a request link, the client enters their FTP, hosting and CMS logins, you collect them once. Then the link is dead, and nothing is ever stored in plaintext on the server.
GDPR-compliant Hosted in the EU Zero knowledge
Why passwords in email threads are a liability
Logins, passwords and documents rarely arrive securely: whoever has to send them to you usually takes the quickest route, email or chat, and that is where they stay.
The credentials never go away
Every new project starts the same way: you need FTP, a hosting login, WordPress admin, DNS. The client sends it all by email, Slack or Teams, often as a screenshot. Those passwords then sit in inboxes, chat histories and personal phones forever, and nobody can say who is still able to read them. One compromised account is enough to expose every client login you hold. Under the GDPR such a security incident can also become a reportable personal data breach.
How it works
Three steps, no account needed on the client side.
Send the request link
Define which credentials you need (FTP, hosting, CMS, DNS) and send the client a single link. Your browser generates the key pair; the private key never leaves your device.
The client enters their credentials
The client opens the link and fills in the fields. Everything is encrypted in their browser against your public key before it is sent. The server only ever sees ciphertext.
Collect once, link is dead
You retrieve the credentials a single time and decrypt them locally. Afterwards the payload is deleted on the server and the link is dead. Nothing is left in an inbox.
Built so we cannot read your clients' data
Zero knowledge is not a promise here, it is the architecture, and the source code is public.
Nothing in plaintext on the server
Encryption and decryption happen in the browser (AES-GCM-256, X25519). We store ciphertext and metadata, never the key, never the plaintext.
GDPR-compliant by design
Data minimisation, one-time reads, short retention. Credentials that no longer exist on any server cannot leak in a breach, which makes your processor duties a lot easier.
Hosted in the EU
Servers and backups stay inside the European Union. No transfer to third countries, no US cloud provider in the request path.
Stop collecting client passwords in your inbox
Set up your agency account in under a minute and send your first request link to a client straight away. Your clients do not need an account.
Free tier, no credit card, no sales call.