Secret Schema

AES-256-GCM encrypted title, base64url-encoded.

12-byte IV for title encryption, base64url-encoded.

Encrypted blob of tags (JSON-serialized array). Plaintext tags MUST NOT be sent.

Optional encrypted free-text notes blob.

Per-scope HMAC-trigram blind index for searchable encryption (ADR 0089). Empty array allowed only when no searchable text was provided at write time.

SEARCH_INDEX_VERSION at write time. Bumped when normalisation rules change; client lazy-reindexes on save.

Type-key (plaintext OK — needed for UI grouping / icons; on its own it does not reveal secret content).

Linked asset UUID

Linked party/customer UUID. NOT a plain link — this field selects the CRYPTO SCOPE: it switches the client to customer-key encryption (`wrappedCustomerKey`), puts the blind index under the customer-SSK, and opens the row to every holder of that customer key in `buildVaultSecretVisibilityFilter`. Only ever set it together with a matching re-encryption. To express "belongs to customer X" for filtering, use `assetPartyId`.

Denormalized `asset.partyId` of the linked asset — assignment/filtering only. Carries NO cryptographic meaning and is deliberately absent from the vault visibility filter. Server-derived; never trusted from the client.

Linked contract UUID

AES-256-GCM encrypted payload, base64url-encoded

12-byte IV for AES-256-GCM, base64url-encoded

Wrapped DEK entries for individually authorized users

Wrapped DEK entries for team-level access

Whether this secret is accessible to all tenant members

Tenant-key-wrapped DEK, base64url-encoded

Version of the tenant key used for wrapping

Vault folder this secret belongs to

Reference to VaultSecretType for custom type definitions

DEK wrapped with Folder Key (AES-KW), base64url

Version of the folder key used for wrapping

DEK wrapped with Customer Key (AES-KW), base64url

Version of the customer key used for wrapping

Key of the import source this secret was created by (e.g. 'tanss', 'lastpass'). Absent for hand-created secrets.

When this secret was written by the import pipeline.

When a user confirmed the imported values are correct. Null/absent on an imported secret means the confirmation panel is still pending.

Internal user UUID who confirmed the import (users._id, not the auth id).

Flagged after key rotation; triggers lazy re-wrap on next access

Timestamp of last successful re-wrap

Zero-knowledge encrypted file attachments stored in S3