How it works

From request to destroyed, step by step.

GoSecretly handles secret and document exchange with the same careful, zero-knowledge process - whether you're sending something via a single-use link, saving a secret straight into one of your own team's Internal Vaults, or handing a whole vault to a client who has no GoSecretly account at all. It starts the moment you register: your organization's own encryption keys are generated in your browser, before your account even exists on our servers. Every path from there requires a fresh authenticator code and is encrypted end to end - except Managed Secrets, an explicit, opt-in exception covered on its own below.

Getting started

Setting up your organization, securely from the first click.

Registration does more than create a login - it's also when your organization's own encryption keys are generated, entirely in your browser, before your account exists on our servers at all.

1Create your organizationPick an organization name and your own admin details, plus a login password - that password only gets you into your account. It never touches the encryption keys that protect what's inside your vaults.

2Save your recovery keyYour organization's encryption key pair is generated right there in your browser, and a recovery key is shown to you once - store it somewhere safe. It's what unlocks your vaults on a new or cleared device, and we never see or store it ourselves.

3Set up two-factor authenticationScan a QR code into any authenticator app and confirm a code - mandatory for every account, with no way to skip it. Every login, and every sensitive action afterward, needs a fresh code from that app.

4Verify your email, then you're inOne last check - confirm the admin email address with a code - and your organization is live. Invite teammates any time; two-factor is enforced for them too, starting from their very first login.

Sharing a secret

For API keys, passwords, and other short secrets.

1Create a single-use linkPick a label and an expiry (5 minutes to 30 days), and GoSecretly generates a one-time link. Send it however you already talk to the recipient - email, Slack, Teams, a ticket.

2They submit, encrypted in their browserNo account needed on their end. Before the secret ever leaves their device, it's sealed client-side against your organization's public key - so it travels and sits in our database as ciphertext, never plaintext.

3You unlock and review itOpening it requires two things only you have: a fresh authenticator code, and (the first time on a device) your organization's recovery key. Decryption happens entirely in your browser - we never see the plaintext.

4Destroy it, or keep it in the vaultClick "Got it" and the ciphertext is permanently deleted - gone for good, including for us. Need it again later? Save it to your Secrets Vault instead, where it stays encrypted until you view it again (fresh code, every time).

Sharing documents

For files - one or many, with a full version history.

1Create a document requestAdd an optional description of what you need, set an expiry, and get a single-use upload link - the same request-link model as secrets, sized for files instead of text.

2They upload, encrypted in chunksFiles are encrypted in the browser in a streaming fashion before upload, so even large files never sit in memory as plaintext, and never touch our servers unencrypted. Multiple files in one request are fine. The uploader marks each file editable or read-only.

3You review, in-browserPDFs, images, Word docs, and spreadsheets preview right in the browser after a fresh authenticator code unlocks them - no separate download-and-open step, and again, decryption never touches our servers.

4Destroy, save, or send back an updateDestroy after reviewing, or save to your Documents Vault with full version history. If a file was marked editable, you can send a revised version straight back - which starts a fresh request the same way.

Internal Vault

Already have the secret? Save it directly.

1Organize into named vaultsCreate as many vaults as you want - one per team, project, or however you think about it - each holding its own set of secrets. Every org starts with one default vault, ready to use immediately.

2Type a key and a valueNo recipient, no link, no waiting on someone else to submit anything - if you already have the secret (an API key, a shared password), just save it straight into the vault you chose. Sealed in your browser before it ever leaves - same zero-knowledge guarantee as the request flow.

3Kept apart, always editableInternal Vaults stay separate from secrets that arrived via a share link, so it's always clear where something came from. Edit the key, value, or expiry any time - each change needs a fresh authenticator code too.

Managed Secrets

Never let a key go stale.

Set a rotation schedule for a secret and GoSecretly reminds you when it's due, then rotates it in one click when you confirm - or holds a value you rotated yourself. Team plans and above.

1Enroll a secret, on purposeA separate, clearly-labeled vault - Team plans and above. Set a rotation schedule (every 24 hours out to yearly, or a custom date) and confirm you understand the trade-off below before anything is stored.

2Get reminded as it's dueEscalating email - and Slack or Teams, if configured - alerts as the rotation date approaches, the same tiered pattern already used for saved-item expiry, just counting down to your schedule instead.

3Rotate with one click, or paste your ownConfirm with a fresh authenticator code and GoSecretly generates a new value on the spot - or update it yourself with a value you already rotated on the provider's own console. Either way, the old value is left untouched until the new one is confirmed, so a failed rotation never locks you out.

4The one deliberate trade-offThis is the single exception to everything else on this page: rotating a secret means GoSecretly has to be able to read it. This vault is not zero-knowledge - by design, and always clearly disclosed, never silent.

External sharing

Hand a whole vault to someone with no GoSecretly account.

Built for an ongoing relationship, not a one-off - a solicitor sharing case files with a client, or a set of credentials a contractor needs for the length of an engagement. Documents and Internal vaults can be shared whole; Secrets vaults can't.

1Turn a Documents or Internal vault into a sharePick an existing vault (or create one just for this) and open External sharing from its page - works for a client's case-file documents or a set of secrets you've saved directly, whole-vault at a time.

2Set who, how long, and how strictEnter the recipient's email - only that address can ever complete the one-time code check - pick an expiry from 1 hour to 30 days, and optionally require a passphrase you send yourself, on top of the emailed code.

3They open it - no account, no plaintext in transitThe share gets its own one-off encryption key pair, generated in your browser; the decrypting half lives only in the link itself, never on our servers. The recipient proves who they are with the emailed code (and passphrase, if you set one), then their browser decrypts everything locally.

4Stay in control while it's liveSync newly-added content into an existing share, remove a single item without killing the whole link, see when it was last opened (plus a one-time email the first time it is), and revoke it outright at any time - the recipient loses access immediately.

Custom Branding

Make it look like yours, not ours.

An agency or a solicitor sending a client a share link shouldn't have to explain what GoSecretly is first - hide our branding, then put your own logo and a line of context in its place.

1Hide our branding, not just yoursSolo plans and above: GoSecretly's own logo, marketing nav, and footer are dropped from every public share page, email, and link preview a recipient sees - a small “Secured by GoSecretly” credit stays, everything else does not.

2Add your own logo and taglineTeam plans and above, from Settings → Branding: upload a PNG, JPEG, ICO, WEBP, or GIF up to 1MB, and set a tagline up to 500 characters - shown in place of GoSecretly's own on the exact same surfaces.

3Shows up everywhere a recipient looksThe share page itself, the notification email's header, and the link preview when it's pasted into Slack or iMessage all reflect it - not just one of them.

4Your own team sees it tooEvery member of your organization (not just Admins) sees your logo and tagline in their own dashboard header, alongside GoSecretly's - a quick confirmation of which org they're working in, especially useful if you're a member of more than one.

Team access

Give (and take away) access without disrupting everyone else.

Every organization starts with one shared recovery key. As your team grows, individual keys let you hand out and pull back access person by person instead - useful the moment someone leaves, or if a device is ever lost.

1Two ways in, not oneEveryone with the organization's shared recovery key (set at registration) can already unlock the vault. Anyone can additionally set up their own individual key from Security settings - a personal keypair, locked with its own personal recovery key, that never touches the shared one.

2An admin grants it, one person at a timeSetting up an individual key doesn't grant access by itself - it just makes that person grantable. An admin reviews who's waiting on the Users page and grants each one individually, wrapping the organization's private key to that specific person's public key in the admin's own browser.

3Revoke just one person, not everyoneThis is the actual point of individual keys: an admin can revoke a single person's access instantly, with no effect on anyone else and no need to rotate the shared recovery key (which is still there as the deliberately harder-to-use, harder-to-misplace fallback).

4Removing someone properly"Remove from org" does more than revoke a grant - it blocks the person's login entirely and anonymizes their account, the same handling used for a GDPR closure request. It doesn't delete their row outright, so the organization's audit trail stays intact.

Slack & Teams notifications

Get pinged where your team already is.

Turn either on from Settings → Notifications by pasting an incoming webhook URL from your own Slack workspace or Microsoft Teams channel - one-time setup, and a “send test notification” button confirms it's wired up correctly before you rely on it. Slack, Teams, and email are all independent - enable any combination of them.

A secret or document arrivesThe moment someone submits a secret or document you requested, a message posts to your channel - a nudge to go look, never the content itself.

Someone opens a vault you sharedThe first time an external recipient opens a vault you shared with them, you get pinged - only once per share, so it doesn't spam the channel on every re-visit.

Something's about to expireSaved secrets and documents get escalating reminders as their expiry date approaches - the same alerts already available by email, just also in Slack or Teams if you want them there too.

What never posts to Slack or Teams: invite links, billing alerts, and account-security events like a recovery-key rotation or an individual key being granted or revoked - those stay on email, sent directly to the people they concern.

Why this is safe

Zero-knowledge, genuinely.

Not a marketing label - we can't decrypt your secrets or documents even if we wanted to, because we never hold the key that could. Here's exactly what that means.

Read the full privacy & data security page →

Your org holds the only keyEvery organization gets a key pair at signup, generated in the browser. The private key is encrypted using a key derived from your recovery key - shown to you once, never sent to us, never stored by us.

We store ciphertext, not secretsSecrets, documents, and the private key that could unlock them are all encrypted before they ever reach our servers. What sits in our database is unreadable bytes, not content.

No recovery key, no recoveryThis is the direct tradeoff of not holding your key ourselves: lose the recovery key and anything in the vault becomes permanently unrecoverable, by anyone, including us.

Two narrow, disclosed exceptionsYour two-factor authentication secret has to be readable by our servers to validate your login codes - encrypted separately, under a key we do hold, same as most services handle 2FA. The second is entirely opt-in: a secret you deliberately enroll in Managed Secrets, so we can rotate it for you - clearly labeled as not zero-knowledge, never silent. Everything else in your vault stays unreadable to us, always.

Ready to see it in your own workflow?

Set up your organization in a couple of minutes - no credit card, no catch.

Create organization