SSO, role-based company vaults and an activity log, on top of an architecture where even your provider cannot read your vault contents. Deploy across thousands of seats without compromising on control.
OIDC with any standards-compliant IdP — Okta, Microsoft Entra ID, Google Workspace, Ping, and more. Users sign in through the directory you already run.
Admins invite, assign and revoke access from the console, and revoking a member removes their vault keys. Automatic directory sync (SCIM) is on the roadmap, not shipped.
Export the activity log as CSV or JSON from the admin console. Streaming to Splunk, Datadog or another SIEM is on the roadmap, not shipped.
Owner, admin and member roles across the organisation, and per-collection roles deciding who administers each company vault.
An exportable, filterable record of administrative and item events, with the actor, timestamp and source IP. Cryptographic tamper-evidence is on the roadmap, so this is an activity log rather than a tamper-proof audit trail.
Hybrid post-quantum key exchange protects shared vault keys against harvest-now-decrypt-later attacks — uncommon among password managers.
Enforce master password strength, session timeouts, device trust, export controls, and IP allow-lists across the org.
Structured, permissioned vaults for teams and departments. Admins manage collections and access from the console; members see and open only the collections they've been granted, from their own vault.
A named account team, priority response SLA, onboarding assistance, and a security questionnaire fast-track.
Most enterprise password managers ask you to trust that they won't look. Walilock is built so they can't. Admins manage identity, policy, and entitlements — but vault contents stay end-to-end encrypted and invisible to admins and to Walilock alike.
How the cryptography works →Provisioning, roles, and policy — never the plaintext inside member vaults.
A compromise of the relay or an admin account exposes ciphertext only.
Vaults work offline and decrypt on-device — no latency, no single point of failure.
Export everything in open formats. No lock-in, ever.