Features
One workspace for the work and the credentials behind it
The agency side and the vault side share the same clients, projects, members and roles. Here is what each half does.
Agency operations
Clients, billing, renewals and reporting
A CRM and finance stack built for service delivery - expenses turn into invoices in a few clicks, and reports build themselves from that data.
Clients & projects
Keep every client and project in one place. Filter by status or tag and see project counts and lifetime revenue per client at a glance.
- Search, status and tag filters on every list
- Per-client project count + total revenue
- Projects carry their own environments and tech stack
- Everything organised per workspace, so nothing gets mixed up
Invoices & expenses
Log billable expenses, then turn a selection into an invoice in one step - line items and billing status always stay in sync.
- Build an invoice from selected unbilled expenses
- Monthly and yearly invoices repeat automatically and are emailed to the client when due
- Mark paid or unpaid, with overdue tracking
- Print a clean invoice or save it as a PDF
Renewals
Track domains, licences and subscriptions with an automatic status so nothing lapses unnoticed.
- Status updates itself: active, expiring soon, expired
- Category and search filters
- Linked to the owning project
- Dashboard widget and a notification for what's due next
Reports & activity
Revenue over time, expenses by category, renewals by status, plus a workspace-wide activity feed.
- Revenue for each month, with the last 3, 6 or 12 months to choose from
- Expenses grouped by category
- Renewals grouped by status
- Filterable activity log of who did what, and when - the last 7 days are kept, with CSV export on paid plans
Client portal
Give each client a private link that shows their projects and invoices - no login, no extra account for them to manage.
- One shareable link per client, no client login needed
- Shows project status and downloadable invoices
- You're notified the first time a client opens their link
- Revoke a link any time from the client's record
- Included on every plan, including Free
Team vault
Typed, encrypted, and wired into the browser
Six record types, built-in 2FA codes, a one-tap extension, expiring share links and a password-health report that never displays your actual passwords.
Typed credentials
Six record types - login, API key, database, SSH key, secure note, payment card - each with the right fields for that type, and all encrypted.
- A proper form for each type, not one big text box
- Encrypted the moment you save
- Only revealed when you choose to view it
- Filter by tag, project and environment
Built-in 2FA codes
Add 2FA to any login and get the 6-digit code right there - no separate authenticator app to juggle.
- Set up by scanning a QR code or pasting a setup key
- Live code with a countdown, right in the app
- Extension copies the code the moment it fills a login
- The 2FA setup key is encrypted, just like a password
Browser extension
One tap on a login that matches the site you're on fills the page - no extra confirmation step, and every credential type shows up in the popup.
- One-tap fill for matching logins
- Works on modern sites, not just simple login forms
- 2FA code copied to clipboard on fill
- Available for Chrome today; Firefox is on the roadmap
Environment variables
Keep your .env files in the vault instead of scattered across laptops. Import a whole file at once and export it back out just as easily.
- Paste an entire .env file and everything is saved at once
- Export back to a ready-to-use .env file
- Empty values are fine - nothing gets rejected
- Organize with folders and tags, share by folder
Password health
A report that flags reused, weak and year-old passwords, plus a check against publicly known data breaches - without ever exposing the passwords themselves.
- Breach check never sends your full password anywhere
- Shows what needs fixing without ever displaying your passwords
- A single 0–100 health score, on every plan
- Each person's report covers only the items they can see
Sharing & access
Three workspace roles, plus viewer, editor and project-admin access that guests get one project at a time - and sharing of single items or whole folders on top.
- Owner, admin and guest roles; guests are limited to the projects they're added to
- Share one credential, or a whole env folder, with chosen teammates
- Guests can only share credentials they created themselves
- Change or remove someone's access whenever you need to
Share links
Hand a single login to someone outside the workspace with a link that expires on its own - no account needed on their side.
- Expiry of up to 24 hours, chosen when you create the link
- Revoke a link early from the credential's list of links
- Every link you create is recorded in the activity log
- Only possible for items you're already allowed to see
Environments & tags
Group credentials by deployment stage and label everything with one shared set of tags, so the vault stays navigable as it grows.
- Create your own deployment stages, such as development, staging and production
- One tag list shared by credentials, env variables and clients
- Filter the vault by project, environment or tag
- Environments and tags are managed by owners and admins
Expiry alerts
Give a credential an expiry date and ClefVault surfaces it before it lapses - on the dashboard and in a weekly email to the owner and admins.
- Expired and expiring-soon secrets listed on the dashboard
- A weekly email digest for owners and admins
- Works on every credential type, from logins to API keys and cards
- Only secrets with an expiry date are tracked
Teams & security
Workspaces, sign-in and day-to-day comfort
Several workspaces per account, mandatory two-factor sign-in, and the small things that keep a team moving.
Teams & workspaces
One account can belong to several workspaces - your own agency, a client's, a side project - each with its own people, plan and data.
- Switch workspace from the sidebar, or create a new one
- Invite by email as an admin or a guest; links stay valid for 7 days
- Disable a member without losing their history, and re-enable them later
- Transfer ownership to another active member - the previous owner becomes an admin
Account security
Everyone signs in with a second factor, and the basics around it are handled for you.
- Two-factor sign-in with any authenticator app, with recovery codes
- Email verification before a new account can log in
- Reset a forgotten password with a time-limited email link
- Deleting a workspace or an account asks for your password again
Notifications & shortcuts
Stay on top of what changes without hunting for it, and get around the app from the keyboard.
- In-app notifications for new clients, projects, invoices, renewals and invites
- Press Ctrl K to jump to any page, from anywhere
- Choose which notifications you receive
- Send a bug report or feature request without leaving the app
How it holds together
Conventions that apply everywhere
Access is controlled everywhere
Owner, admin and guest roles apply across the whole workspace, and guests get viewer, editor or project-admin access one project at a time - so a client or contractor never sees more than you intended.
You'll never lose data to a plan change
If you're near a plan limit, you'll get a clear upgrade prompt before adding something new. Anything you've already added stays exactly as it is - and your new limits apply the moment your plan changes.
One set of tags for everything
Label clients, credentials and env variables the same way. Tags are shared across the whole workspace, so you're not keeping separate lists in sync by hand.
Search and filter, consistently
Every list in the app - clients, invoices, vault items - works the same way: search, filter, done. No new interface to learn per section.
Start free, invite the team when you're ready.
No card required. Every plan includes a fixed number of seats, so there is no per-user math to do.