SSO, role-based company vaults and an activity log, on top of an architecture where even your provider cannot read your vault contents. Deploy across thousands of seats without compromising on control.
OIDC with standards-compliant identity providers, tested with Okta. Users sign in through the directory you already run.
SCIM 2.0 provisioning adds people and groups from your identity provider, and removing someone there removes their access and their vault keys. Admins can also invite, assign and revoke access from the console. Tested with Okta.
Export the activity log as CSV or JSON from the admin console, on Business as well. Streaming to Splunk, Datadog or another SIEM is on the roadmap, not shipped.
Owner, admin and member roles across the organisation, and per-collection roles deciding who administers each company vault.
An exportable, filterable record of administrative and item events, with the actor, timestamp and source IP. Cryptographic tamper-evidence is on the roadmap, so this is an activity log rather than a tamper-proof audit trail.
Hybrid post-quantum key exchange protects shared vault keys against harvest-now-decrypt-later attacks. On Family, Business and Enterprise.
Restrict sign-in to your network with an IP allow-list, require passkeys for the sites you choose, and decide who can create company vaults and how long invites stay open. On Business as well. Master password rules and session timeouts are on the roadmap, not shipped.
Structured, permissioned vaults for teams and departments. Admins manage collections and access from the console; members see and open only the collections they've been granted, from their own vault.
A named account team, priority response SLA, onboarding assistance, and a security questionnaire fast-track.
Most enterprise password managers ask you to trust that they won't look. Walilock is built so they can't. Admins manage identity, policy, and entitlements — but vault contents stay end-to-end encrypted and invisible to admins and to Walilock alike.
How the cryptography works →Provisioning, roles, and policy — never the plaintext inside member vaults.
A compromise of the relay or an admin account exposes ciphertext only.
Vaults work offline and decrypt on-device — no latency, no single point of failure.
Export everything in open formats. No lock-in, ever.