THE TEAM SERVER

FilePilot Enterprise Vault

The team server that gives everyone secure access to your servers — without sharing passwords. You decide who can reach what, and keep a tamper-proof record of every action.

Set Up the Vault → View GitHub Repo
FilePilot Enterprise Vault - dashboard_view
FilePilot Enterprise Vault Administration Console
[ ZOOM VIEW ]

The Problems It Solves

Unmonitored Transfers

When everyone uses their own file-transfer app, you have no idea what data is leaving your network — or who sent it.

Scattered Credentials

Server passwords and keys end up saved on dozens of laptops — a security incident waiting to happen.

Failed Audits

Without one central, tamper-proof record of every transfer, proving compliance (like SOC 2 or HIPAA) is a nightmare.

01 — Getting Started

Setup & Installation

Deploy the Enterprise Vault in minutes. A browser-based wizard guides you through database selection, master key setup, and your first admin account.

Guided Setup Wizard

Visit /admin on your server and a browser wizard walks you through database selection, master key setup, and admin account creation — no CLI knowledge required.

Multi-Database Support

Use embedded SQLite for small teams, or connect to an existing PostgreSQL or MySQL cluster for high-availability enterprise setups.

Database Connectivity Test

Test the database connection directly from the setup wizard before saving. Catch credential or network issues before they cause problems.

Config-Driven Architecture

All settings live in config.json and a SystemConfig table. Reproducible deployments, easy infrastructure-as-code integration.

Environment Variable Overrides

Set sensitive values like the master key via environment variables. Compatible with Kubernetes secrets, Docker env vars, and CI/CD pipelines.

Enterprise Vault Admin Login
[ ZOOM ]
02 — Admin Security

Secure Sign-In for Admins

Two-factor login, automatic lockout after failed attempts, and full control over active sessions — strong protection for the admin panel, right out of the box.

Session-Based Auth
Secure HTTP-only cookie sessions with hashed tokens stored server-side — no long-lived JWTs to worry about rotating.
CSRF Protection
Every state-changing request requires a valid CSRF token. Eliminates an entire class of web attacks with zero user friction.
MFA (TOTP)
Standard time-based OTP — compatible with Google Authenticator, Authy, and 1Password. Full enrollment and recovery flows built in.
Backup Codes
Eight one-time backup codes, bcrypt-hashed. Use one if you lose your authenticator device and set up a new one safely.
Login Lockout
After 5 failed attempts in 10 minutes, the IP is automatically locked out. Brute-force attacks are stopped cold.
Session Management
See every active session — device, IP, login time. Kill individual sessions or all other sessions with one click.
User & Role Management
[ ZOOM ]
03 — Access Control

Control Who Can Do What

Give each person exactly the access they need with four ready-made roles and 20+ fine-grained permissions — enforced on the server, not just hidden in the interface.

4 Built-in Roles
Admin has full access. Manager oversees vaults, profiles, and tokens. Operator creates profiles and issues tokens. Auditor gets read-only audit log access.
20+ Granular Permissions
Fine-grained permissions like profile.create, token.revoke, audit.export, and legal_hold.manage. Build exactly the access model your compliance policy requires.
Wildcard Matching
Grant profile.* for all profile actions at once, or be precise with profile.view only. Concise when you want, precise when you need.
API-Level Enforcement
Every endpoint verifies permissions server-side. Even a direct HTTP request bypassing the frontend gets rejected if the role doesn't permit it.
Vault Groups & Encryption Isolation
[ ZOOM ]
04 — Organization

Vault Groups

Sort your server logins into separate groups — one per team, project, or environment. Each group has its own encryption key and its own list of allowed IP addresses.

Group-Based Organization
One group for DevOps, one for DBAs, one for staging — each completely isolated from the others.
IP Allowlisting
Restrict which IPs can pull profiles from a group. Only laptops on your VPN can access the production group.
Per-Group Encryption Keys
Each group has its own Data Encryption Key. Even if one group's DEK is compromised, the others remain protected.
Per-Group KMS Provider
Your EU team's group uses Azure Key Vault; your US team's uses AWS KMS. Full data sovereignty, per team.
SSRF Protection
Hostnames are validated against private IP ranges. No one can register a profile pointing to internal cloud metadata endpoints.
Connection Profile Provisioning
[ ZOOM ]
05 — Provisioning

Manage Server Logins in One Place

Keep every server login in one place. Create one, test it, and it's instantly available to every approved teammate — no emailing passwords around.

Centralized Profiles
Full CRUD for connection profiles across all protocols: FTP, SFTP, FTPS, SCP, S3, and WebDAV.
Encrypted Storage
Every password and key is AES-256-GCM encrypted with the group's unique DEK. Raw credentials never appear in plaintext.
Test Before Deploy
Click 'Test Connection' to verify a profile works before provisioning it. Catch typos before anyone notices.
Automatic Client Sync
Save a profile and it's immediately available to any desktop client with a valid token for that group.
Token-Scoped Delivery
Each token only grants access to profiles in its specific Vault Group. A staging token can't pull production credentials.
06 — Access Keys

Access Keys

Hand out secure access keys, then track, block, or cancel them anytime. Each key works for just one person and one group, and can expire on a date you choose.

256-bit Tokens

Cryptographically secure tokens generated server-side. The raw token is shown exactly once — never stored again.

SHA-256 Hashing

Only the hash is stored in the database. If the database leaks, token hashes can't be reversed to the originals.

User & Group Scoped

Every token is tied to a specific user identity and vault group. Can't be reused across groups or impersonate other users.

Expiration Dates

Set optional expiry dates. Expired tokens are blocked automatically — no cron job or admin action needed.

Instant Revocation

Block a token from the admin panel and the connected desktop client loses access within seconds via WebSocket notification.

Legal Hold Protection

Tokens belonging to a group under Legal Hold cannot be deleted or reissued for the duration of the investigation.

Encryption Key Management & Rotation
[ ZOOM ]
07 — Encryption

Encryption & Key Management

Two-tier envelope encryption with rotatable master keys, per-group data keys, and pluggable KMS backends — from AWS to HashiCorp Vault.

Envelope Encryption
Master KEK wraps per-group DEKs, DEKs encrypt credentials. Compromising one layer doesn't expose the other.
AES-256-GCM
Every value uses AES-256-GCM with random 96-bit IVs and authentication tags. Tampering is detected and rejected automatically.
Master Key Rotation
Rotate the KEK from the admin panel. All group DEKs are re-wrapped under the new key without exposing raw credentials.
Resumable Rotation
If the server crashes mid-rotation, it picks up from the last completed group — no partial rotations or data loss.
Multi-KMS Support
Plug in AWS KMS, Azure Key Vault, GCP Cloud KMS, or HashiCorp Vault. Each group can use a different provider.
Tamper-Evident Audit Trail
[ ZOOM ]
08 — Audit Trail

A Record No One Can Secretly Change

Every action is written to a log that's cryptographically linked together. Change or delete even one entry and the chain breaks — so tampering is impossible to hide.

Hash Chain
Every audit entry contains a SHA-256 hash of itself plus the previous entry. An unbreakable chain that catches any tampering.
Integrity Verification
An admin API endpoint verifies the complete chain and reports the exact entry where it breaks, if any.
Structured Metadata
Who did what, when, and from which IP — all recorded as structured, queryable JSON.
CSV Export
Export filtered audit data for your compliance team. Filter by date range, action type, or user.
Log Archival
Archive old entries to hide them from the main view without deleting. They remain immutable and available for review.
09 — SIEM Integration

SIEM Webhook Integration

Stream audit events to your SIEM in real time — with HMAC-signed payloads, automatic retries, and failure logging built in.

Configurable Endpoint

Point the Vault at your Splunk, Datadog, ELK, or any custom webhook receiver with a single URL.

HMAC-SHA256 Signatures

Every payload is signed with a shared secret. Your SIEM verifies the signature to confirm the event is authentic.

Retry with Backoff

Failed deliveries retry 3 times (1s → 4s → 16s). Transient outages don't cause audit gaps.

Failure Logging

If all retries fail, the delivery failure is itself recorded in the audit trail. You always know when events didn't reach your SIEM.

10 — Compliance

Legal & Preservation Holds

Freeze an entire Vault Group for regulatory review. Tokens can't be deleted, profiles can't be modified, and the access record remains intact.

Activate Legal Hold

Place any group under hold with a reason, responsible user, and timestamp. Data enters locked-down mode immediately.

Write Freeze

Optionally freeze all writes — profile edits, token issuance, token deletion. Data is preserved in its exact state.

Token & Profile Protection

Tokens and profiles within a held group cannot be deleted. The access configuration is preserved for the investigation.

Client Notification

Hold status and freeze flags are pushed to connected clients via the sync API. Users see the hold status in their app.

Release Hold

Remove the hold from the admin panel when the review ends. All restricted operations become available immediately.

File Version History & Revert
[ ZOOM ]
11 — Version Control

File History & One-Click Undo

Every file uploaded through a connected app is saved as a version. Browse the history, look at older copies, and roll any file back with one click.

Automatic Snapshots
Every upload creates a version snapshot with SHA-256 hash and file size. No manual action required.
Version History
Browse all versions in the admin panel with timestamps, sizes, and the user who uploaded each one.
Content Viewer
View the actual content of any past version directly in the admin panel without downloading it.
Remote Revert
Push any past version back to the connected client with one click. FilePilot writes it to the server via WebSocket.
Offline Revert Queue
If the client is offline, the revert is queued. The moment it reconnects, the operation completes automatically.
12 — Real-Time Sync

Real-Time Updates

Connected apps stay linked to the Vault at all times. When you cancel a key, undo a file, or freeze a group, it takes effect within seconds — not on the next sync.

Persistent Connections Clients maintain a live WebSocket channel after authenticating. The backbone for all real-time operations.
Instant Token Events Block a token and the client loses access within milliseconds. Restore it and access returns without user action.
Live File Reverts File revert commands travel over WebSocket. The client receives the content and writes it immediately.
Compliance Posture Dashboard
[ ZOOM ]
13 — Compliance Dashboard

Compliance Posture Dashboard

Five posture panels covering encryption, access control, audit integrity, IP policy, and session security — formatted to answer the exact questions your compliance auditor will ask.

Encryption Posture
KEK rotation history, per-group KMS provider, and DEK version status — all on one screen.
Access Control Posture
All users, roles, MFA status, active tokens with age and last-used timestamps.
Audit Integrity
Full hash chain verification. Tells your auditor exactly how trustworthy the logs are.
Access Policy
IP allowlist coverage per group. Spot groups with no restrictions that represent a wider access surface.
Session Security
Configured timeouts, max concurrent sessions, and current active session count across all users.
Enterprise Vault Admin Dashboard
[ ZOOM ]
14 — Admin Panel

One Dashboard to Run It All

A rich single-page admin interface with live metrics, full CRUD for groups, profiles, tokens, and users — plus audit viewing, compliance reports, and system settings.

Live Dashboard
Active WebSocket connections, total file versions, recent audit entries, and database backend — all updating in real time.
Group & Profile Management
Create, edit, delete vault groups and connection profiles. Configure KMS, IP policies, and encryption per group.
Token Management
Issue, view, block, unblock, and revoke access tokens with one click. See status, expiry, and usage data.
Audit & Compliance
Browse the audit trail with filters, verify chain integrity, export to CSV, and view the five-panel compliance dashboard.
System Settings
SIEM webhook, SMTP email, backup schedule, database configuration, and KEK rotation — organized into tabs.
FAQ

Frequently Asked Questions

The client authenticates with the Vault using an access token over HTTPS, then maintains a persistent WebSocket connection for real-time events. Encrypted connection profiles are delivered through the REST API.

Yes. The Enterprise Vault is a standard Node.js application. Deploy it on your own servers, in Docker, or in any cloud provider. Your data never leaves your infrastructure.

No. The Desktop Client works perfectly as a standalone application. The Vault is only needed for team provisioning, role-based access control, and audit logging.

SQLite for simple single-server deployments, PostgreSQL and MySQL for production clusters. You can switch between them at runtime from the admin panel.

Yes. Both products are MIT licensed with no premium tiers, no per-seat licensing, and no telemetry. Deploy it for your 500-person engineering org at zero cost.

PRODUCT ECOSYSTEM

Provision and audit centrally

Secure your developers' workstations by routing configurations and audits through the Enterprise Vault.

Download Vault Server → View GitHub Repository →
STEP 01 Desktop Client Blazing-fast dual-pane visual file transfers.
STEP 02 Terminal Shell Vibrant multi-tab command terminal splits.
STEP 03 Enterprise Vault Centralized credential sync, policy, & audit.
STEP 04 Download & Deploy Get native installers for Windows, macOS, & Linux.