Secrets management & managed compute
Secrets, compute, deploys. Managed end to end.
Keys and credentials live in an encrypted vault your apps read at runtime — never a repo, never an env file. Those apps run on hardware we provision, attest and patch, with network, TLS and zero-downtime releases handled. You write the application.
0/1 Vault
Secrets that never touch your repo.
Keys, credentials and the sensitive data your applications need at runtime live in hardware-isolated vaults. They reach your workloads over attested, encrypted channels and nowhere else — not a repo, not an env file, not a CI variable.
Read the Vault docsDynamic key–value
Short-lived secrets minted on request and expired on a schedule you set, so a leaked value is worthless by the time anyone finds it.
SSH credentials
Signed, expiring SSH certificates instead of long-lived keys scattered across laptops. Revoke access once, everywhere.
Attested delivery
A workload proves what it is before a secret is released. Unattested machines get nothing, even with the right token.
Versioned and audited
Every read, write and rotation is recorded. Roll back a secret without redeploying the app that consumes it.
- API keys & tokens Stripe, payment gateways, third-party services
- Database credentials connection strings, passwords, replica sets
- SSH keys & certificates deploy keys, host keys, short-lived certs
- TLS private keys certificates and the keys behind them
- OAuth & webhook secrets client secrets, signing secrets
- Encryption & signing keys JWT signing, code signing, data keys
- Cloud provider credentials service accounts, access keys
- Structured config whole .env files and schema-validated groups
0/2 Compute
Managed compute, forged from metal.
We never sell raw boxes — only compute. Bring your own bare metal, or run on ours. Either way the OS and your stack come pre-installed, deploys are git-driven, and the machine is managed end to end.
Read the Compute docsYour metal or ours
Bare metal, direct compute or VPS. Bring hardware you already own and pay only for management, or buy a compute plan from us.
Git CI/CD
Push to deploy. We pull, build and run your script — with a health check before anything takes traffic, and rollback when it fails.
Blue-green deploys
New release, health check, swap. A bad commit costs a restart, not an outage.
Autoscale and HA
Clusters that grow with load and survive a node loss, including a highly available database, without you writing the orchestration.
- Bring your own metal You own the hardware and the hosting contract. We turn it into managed compute — confidential or standard — and run it. Pay the management fee only.
- Compute on our metal We run the hardware and publish compute plans from the capacity available. You buy compute, never the box.
- Direct compute / VPS Platform-owned compute for workloads that do not need a whole machine.
0/3 Deploy
Push a commit. We do the rest.
Install the prerequisites, pull the branch, run your build command, swap traffic with zero downtime, then watch it. You decide how your application is built; we handle create, install, deploy, run and monitor.
Read the Deploy docsPrerequisites first
Runtimes, system packages and services your app needs are installed and pinned before a single line of your code runs.
Clone or pull, then your script
Point at a repository and a branch. We fetch it and run the command you nominate — no proprietary build format to learn.
Zero-downtime swap
The new release starts on its own slot and has to answer a health check before traffic moves. A failed release never receives a request.
Public hostname and TLS
Bind a domain, prove you control it with a DNS record, and it is served over a private tunnel with certificates renewed for you. No public port is ever opened.
Network & firewall
Closed by default. Opened where your app needs it.
Part of managed compute, not a separate product. Every node is hardened the same way, so there is no per-box firewall drift to audit.
Closed by default
Inbound denied except SSH. Your application port is never opened — traffic arrives through the tunnel.
Private tunnels
No public ingress to the box at all. The tunnel dials out, so there is no listening port to scan.
Private and public networks
Managed end to end. Nodes talk to each other privately; only what your app serves reaches the internet.
Anycast routing
Requests land in the nearest of six regions without you running a global load balancer.
Security model
We keep the keys. You keep shipping.
Post-quantum throughout, and no password anywhere in the system. Secrets live in vaults, compute runs memory-encrypted, and the root of trust is split across custodians who each hold one share of it.
-
Post-quantum throughout
The security model is post-quantum, not classical crypto with a migration plan filed for later.
-
No password to steal
Accounts are a passkey plus a 24-word recovery phrase only you hold. There is nothing on our side to phish or breach.
-
M-of-N custodian ceremony
The master seed is split into shares, one per custodian, each sealed under both a passkey and a seed-phrase envelope. Changing a custodian takes a quorum — approve, enroll, unlock.
-
SEV-SNP confidential compute
Memory encrypted and guest-attested on supported metal, so even the host cannot read your workload.
-
Hardware attestation
Every boot is measured against known firmware. A machine that cannot prove what it is gets no secrets.
-
Route-level RBAC
One access matrix keyed by route governs pages and API actions alike. New admins and new roles need a quorum vote before they grant anything.
- Vault-held secrets keys & secrets, attested delivery only SEALED
- SEV-SNP confidential compute memory encrypted, guest-attested ENCRYPTED
- Hardware attestation every boot measured against known firmware VERIFIED
Plans
Vault from free · compute from €9 · deploy from €9
Three products with their own tiers, or one Global plan that maxes all three. Vault is priced per account. Compute management is priced per compute and deploys per application — both multiply by how many you run. Buying the compute itself is separate and shown once you sign in.
Vault per account
Priced by how much you store and which capabilities you need.
-
Free
Enough to actually run something small.
Free
- 25 entries, 1 project, 2 members
- Passkey sign-in and recovery phrase
- Versioned secrets and full audit log
- Community support
-
Starter
Room for a real application and a small team.
€9 per mo
- 250 entries, unlimited projects, 5 members
- Environment separation
- Scheduled rotation and SSH key storage
- Email support
-
Pro
Schemas, dynamic credentials and approvals.
€29 per mo
- 2,500 entries, unlimited members
- Schema-driven secrets, certificates, files
- Dynamic credentials and short-lived SSH certs
- Custom approval policies
Compute management per compute · multiplies
The rate applies to every compute we manage, ours or yours — ten computes on Standard is ten times the Standard rate. Buying the compute itself is separate and shown once you sign in.
-
Free
One machine, watched but not touched.
Free
- 1 compute, yours or ours
- Provisioning and prerequisite profiles
- Health monitoring and alerts
- Community support · no patching SLA
- MOST CHOSEN
Standard
Scaling, private networking and backups.
€9 per compute / mo
- Everything in Basic
- Autoscale within the compute
- Private networking and vRack
- Scheduled backups and restore
-
Advanced
Confidential compute and clustered workloads.
€29 per compute / mo
- Everything in Standard
- SEV-SNP confidential compute where supported
- HA clusters and multi-node orchestration
- Priority support
Deploy per application · multiplies
Priced per application, not per machine — several applications commonly share one compute, and charging per machine would penalise exactly the teams packing efficiently.
-
Free
One application, deployed by hand.
€0 per app / mo
- 1 application
- Prerequisite install profiles
- Clone or pull, then run your command
- Deploy on demand · logs kept 7 days
- MOST CHOSEN
Continuous
Push a commit, we do the rest.
€9 per app / mo
- Everything in Manual
- Git-triggered releases on push
- Blue-green swap with health gate
- One-click rollback, 30-day history
-
Pipeline
Environments, approvals and canaries.
€29 per app / mo
- Everything in Continuous
- Staging to production promotion
- Canary releases and auto-rollback
- Deploy approvals and full audit trail
Run more than one? Pay less for all of it.
Global is not a fourth plan — it is a discount on whatever you already chose. Keep the tier you want for each product; the more of them you enable, the less the combined bill is.
- −15% Any two products
- −25% All three products
For example
- Vault Starter
- €9
- Compute Standard × 2
- €18
- Deploy Continuous × 3
- €27
- All three — save 25%
- −€14
- Per month
- €40
Where the compute comes from
We never sell you a box. Management is the same tier either way — only the source of the hardware changes.
Buy compute from us
Sizes and prices come from capacity we actually run, published by your platform admin. Shown once you sign in, with a management tier on top.
Bring your own metal
You keep the hardware and the hosting contract. We provision compute on top, confidential or standard depending on what the machine supports, and run it.
Every account receives identical cryptographic isolation — plans differ by capability and scale, never by how well your secrets are protected. Volume and multi-region pricing on request, talk to an engineer.
Docs
One command to a working device.
- QUICKSTART
Set up a device
One command on a bare box: prerequisites, install, and your first-time platform invite link.
curl -fsSL https://forgezero.net/setup.sh | bashOpen - GUIDE
Deploy from git
Wire push-to-deploy with health checks and automatic rollback.
Open - GUIDE
Vault in your app
Read secrets over an attested channel instead of an env file.
Open - REFERENCE
API
Every action route, typed end to end — generated from the same schemas the API validates against.
Open