PBJ Vault

A locked cabinet for the client details you can’t afford to leak.

Door codes in a text thread, router passwords in a spreadsheet, account numbers on a sticky note. Vault keeps them on the client’s own record in PBJ CRM, encrypted, and shows one only when someone on your team deliberately reveals it.

$25 one-time per major version · Requires PBJ CRM ($50) · One key covers 3 sites

Buy PBJ Vault, $25

View PBJ Vault changelog

Kept with each client

Equipment, network settings, account numbers and door codes, filed on the client’s record.

Encrypted and hidden

Selected fields are encrypted, and lists and records keep them hidden.

Every reveal recorded

Unlock to reveal or copy one field. Every reveal is recorded, and the Vault relocks after 30 idle minutes.

Pay once. Keep the key.

Vault is $25 one-time per major version, and it runs inside PBJ CRM ($50, also one-time). There is no monthly fee and no per-seat fee. Every update within this major version is free, and one license key covers 3 sites.

Already run PBJ CRM?

Add Vault for $25.

Buy PBJ Vault, $25

New to PBJ CRM?

Start with the CRM, then add Vault.

PBJ CRM

How it fits PBJ CRM

Vault is a module of PBJ CRM, not a separate app. It adds a Vault area to the CRM portal and files every record on a CRM business, person or staff member.

The CRM holds the customer

Your clients, team and staff levels already live in PBJ CRM. Vault uses them, so nothing is set up twice.

Vault holds the secrets

Make sub-databases such as Networking or Door & alarm codes. Pin each record to the right customer with the CRM picker.

You reveal from the client’s record

On the customer’s Work › Vault tab, the entry sits beside everything else. Unlock and reveal just the field you need.

Watch it stay locked

Names, labels, dates and pins stay readable, so you can find the right entry. The protected values stay sealed.

Honest limit: while the Vault is unlocked, the server holds a working key until it locks again.

Features

Record types you design. Make sub-databases such as Networks, Door codes or Licence keys, with up to 20 fields each, or start from a spreadsheet and review the import before it is saved.
Protected fields are encrypted. Secret values are stored encrypted, not just hidden. A copy of your database or a backup is useless without the passphrase. A backup taken while the Vault is open still can’t be decrypted: part of the working key lives only in your browser.
A passphrase only you hold. Unlock with a passphrase over a secure HTTPS connection; a one-time recovery code is shown for you to print and keep. Or unlock with a passkey (Face ID, Touch ID, Windows Hello or a security key) after the first passphrase unlock. It locks after 30 idle minutes by default (you can set 5 to 120), or at once with Lock now.
Filed against your customers. Each record is pinned to the businesses, people or staff it concerns, and appears on their profile where the rest of their file already is.
Reveal one value at a time. A password or code is shown only when someone presses Reveal: one protected value per request, never the whole record at once.
Control who can see what. Set a minimum staff level for each record type, and name particular people who may open a particular record.
Useful even when locked. Names, lists and filing locations stay visible to your team; only the protected values are withheld. So never put a secret in a record’s name.
A trail and a self-test. Unlocks, reveals and security actions are recorded; the secret values themselves are never written to the log. Run a built-in security self-test with throwaway data.

How it works

Real screens from PBJ CRM with sample customers. Names, emails and phone numbers are made up.

The Vault, locked: sub-databases and Vault settings.

1. Prepare

Run the built-in security self-test, set a passphrase of at least 12 characters separate from your WordPress password, and keep the one-time recovery code offline. Make a sub-database such as Networking with up to 20 fields, and choose which are protected.

Add a record: plain fields, protected fields and the Vault passphrase box.

2. File it on the client

Give each record a useful non-secret name and pin it to the business, person or staff member with the CRM picker. It appears on their profile.

An entry opened while the Vault is locked: names stay readable, protected values do not.

The Vault on a phone.

3. Unlock, reveal, lock

Unlock with the passphrase, or add a passkey after the first unlock. Reveal shows one protected field and records it in the audit trail. It locks after 30 idle minutes by default (adjustable from 5 to 120), or at once with Lock now.

Built for

IT and managed services

Each client’s network settings, with sensitive fields encrypted and reveals recorded.

Trades

Door codes and equipment details with each client.

Professional offices

Account numbers encrypted; every reveal recorded without logging the value itself.

Events and AV

Equipment and network settings on each client’s record, locked when you walk away.

How it helps your business

Five everyday examples, step by step. Your own business will look different, but the pattern is the same.

Managed IT and tech support

After you set up a client’s office network, you file the router address, admin password and internet account number as one Networks record. Next time a technician is sent there, they unlock the Vault, open the client’s profile and reveal the admin password. The Vault keeps a log of who unlocked it and who revealed a value.

Trades and field service

You fit a new alarm panel at a customer’s shop and file the door and alarm codes against that business. Back at the office you unlock the Vault, find the record from the customer’s profile and reveal only the code you need. A technician can be named on that one record, and no one else on the team sees it.

Hospitality and venues

A restaurant’s Wi-Fi, back door code and point-of-sale licence key each live in a record under the restaurant. Your manager sees the names and where things are filed even when the Vault is locked. Revealing a code requires an unlock, and the cabinet locks itself again when you walk away.

Professional offices

A law firm asks you to keep its server login and software licence keys safely. You create a Licence keys type, set it to partners and managers only, and add each key as a protected field. A future audit can see who unlocked and revealed what.

AV, music and events production

A venue’s sound desk has a locked admin login and a rack network with its own passwords. You file both under the venue as protected records. A freelance engineer is granted one record for the weekend, and the grant can be taken away afterwards.

Works with the rest of the suite

PBJ Vault is a module of PBJ CRM and needs it installed. It shares the CRM’s staff, customers, connected mailboxes and theme, so nothing is set up twice. These other PBJ modules also need PBJ CRM and sit alongside it:

PBJ Helpdesk — mail-to-ticket support with response targets and a client portal.
PBJ Invoicing — estimates, invoices, card payments and repeat billing.
PBJ Dispatch & Appointments — book visits and appointments and work them through to done.
PBJ RingCentral — your RingCentral texts, calls and voicemail beside the customer.
PBJ Templates — one designer for emails, notices, invoice layouts and documents to sign.
PBJ Omada — TP-Link Omada network alerts, device status and Help Desk tickets on the client record.

Running an IT shop? Vault pairs with Helpdesk and Omada on the same client record.

One-time pricing, spelled out

PBJ Vault is $25 one-time per major version. You are buying this major version: every improvement within it arrives free through the built-in update channel. A future major version is a separate purchase if you want it — your copy keeps working either way. One license key covers 3 sites.

Requires PBJ CRM (latest version) ($50, sold separately). Vault records live inside the CRM portal and pin to the CRM’s companies and contacts.

Buy PBJ Vault

$25 one-time — per major version Includes a license key for 3 sites, instant download, and free updates within this major version. Requires PBJ CRM (latest version).

Install PBJ CRM first, then install Vault from the download page you reach after purchase. Your site must use HTTPS. Enter your licence key under Settings for updates.