Sub-databases you design, or build from a spreadsheet. Define record types — Networks, Door codes, Equipment, Licence keys — with up to 20 fields each. Or upload a CSV: the top row becomes the fields, the rows become records, and columns that look secret (passwords, codes) are flagged automatically.
Real encryption, not obfuscation. Secret fields are encrypted with XChaCha20-Poly1305 or AES-256-GCM under a vault key that is itself sealed by your passphrase. A stolen database, a stolen backup, a copied server file — all useless without the passphrase.
A vault with a key you hold. Set a passphrase; get a one-time 24-character recovery code shown exactly once with a print prompt. Unlock to work; it locks itself after idle time or with one click. Locked, your team still sees record names and lists — only the secret values are withheld.
Secrets pinned to clients. Every record pins to the companies, contacts and agents in your PBJ CRM, and shows up on their profile — the cafe’s router password lives on the cafe’s record, where the rest of the cafe’s file already is.
Reveal one field at a time, audited. Values decrypt only when someone presses Show, one field per request — and every reveal, edit, grant and unlock lands in an audit trail.
Access that matches your team. Per-type minimum staff level, plus per-record grants to named employees for the deliberate exception. Someone who merely holds a grant can never widen it.
Honest about what encryption can and cannot do. The threat model is printed in the product, in plain words: this defeats stolen data at rest; it does not defeat somebody who knows the passphrase. We do not call it zero-knowledge, because server-rendered software cannot honestly claim that.
Works on ordinary shared hosting. If your server lacks the fast key-derivation extension, the vault says so on screen in plain words, falls back safely, and tells you the one sentence to send your host.
