Skip to main content
DataRaven’s Bring Your Own Vault (BYOV) architecture ensures your cloud credentials never touch our infrastructure. Connect your existing secrets manager and DataRaven will resolve credentials at transfer time.
BYOV is optional. DataRaven also provides built-in secret storage powered by AWS SSM Parameter Store SecureString, so you can store credentials securely without connecting an external vault.

​
Supported Vaults

1Password

Connect via Service Account token.

Doppler

Project-level access tokens.

Infisical

Machine identity authentication.

​
How It Works

  1. Connect your vault — Provide DataRaven with a scoped access token for your secrets manager
  2. Create secrets — Map DataRaven secret names to paths in your vault
  3. Reference in locations — When configuring a location, reference vault secrets instead of entering credentials directly
  4. Zero-knowledge resolution — At transfer time, DataRaven resolves the secret, uses it for the rclone operation, and discards it immediately

​
Setting Up a Vault Connection

​
Via Dashboard

  1. Go to Settings → Vault Connections
  2. Click Add Connection
  3. Select your vault provider
  4. Enter the required token/credentials
  5. Click Test to verify the connection

​
Security Model

  • DataRaven never stores your cloud provider credentials
  • Vault tokens are encrypted at rest and scoped to minimum required access
  • Credentials are resolved in-memory at execution time and immediately discarded
  • All vault operations are logged for audit purposes