Unrotated API keys and tokens are the most common entry point for credential theft. MDRwatchdog Vault™ rotates your credentials across Cloudflare, GitHub, AWS, Stripe, and seven other platforms automatically—and seals every rotation event to a quantum-resistant audit chain with a timestamp any auditor can verify. Your credentials are encrypted in your browser before they leave your machine. We store only ciphertext. We cannot read your secrets.
When you add a credential, the value is encrypted with AES-256-GCM in your browser tab using a key derived from your session. The encrypted value — ciphertext — is what MDRwatchdog receives and stores. We never see the plaintext.
Press Rotate. The vault calls the platform API, creates the new credential, verifies it works, then revokes the old one. If verification fails, the old credential stays active. You are never left without a working key.
The rotation event — platform, credential name, timestamp, verification result — is sealed with Ed25519 + ML-DSA-87 (NIST FIPS 204). Your auditor gets cryptographic proof of exactly when each credential was rotated.
Each platform rotator creates the new credential, verifies it, then revokes the old one — in that order. Verification failure rolls back without revoking. The full sequence is audited.
CMMC IA.L2-3.5.2 requires managing authenticators — rotating them when they may have been exposed and on a schedule. The most common failure during a C3PAO assessment is no documented evidence that credentials were rotated at all.
NIST SP 800-171 3.5.2 maps directly to the same requirement. Your SPRS score deducts points for unmet authenticator management controls. MDRwatchdog Vault™ produces the rotation evidence that satisfies this control.
Cyber insurance applications increasingly ask whether you rotate credentials and on what schedule. A timestamped, cryptographically sealed rotation history gives your underwriter a verifiable answer — not a claim.
SOC 2 CC6.1 requires logical access controls including credential management. The audit-sealed rotation history demonstrates continuous compliance rather than a point-in-time snapshot.
Zero-knowledge means MDRwatchdog never receives, stores, or can read your plaintext secret values. When you add a credential, it is encrypted in your browser using AES-256-GCM before the data leaves your machine. The encryption key is derived in your browser from your login session and is never transmitted. MDRwatchdog's servers receive and store only ciphertext. Even a complete breach of MDRwatchdog's infrastructure would yield attackers nothing but encrypted blobs they cannot decrypt.
NIST SP 800-171 control 3.5.2 (IA.L2-3.5.2) requires authenticator management, and NIST guidance recommends rotating credentials when they may have been exposed. CMMC Level 2 maps directly to this control. Credential rotation evidence — specifically, documented proof that credentials were rotated on specific dates — supports your IA control coverage and your SPRS score. MDRwatchdog seals every rotation event to the quantum-resistant audit chain, producing timestamped, cryptographic proof of rotation that satisfies assessor documentation requirements.
The vault calls the platform's API directly from your browser session or the MDRwatchdog vault binary running on your machine. It creates a new credential, verifies the new credential works, then revokes the old one. The new credential value is encrypted in your browser before being sent to MDRwatchdog for storage. The rotation event — including platform, credential name, timestamp, and verification result — is sealed to the audit ledger with Ed25519 and ML-DSA-87 signatures. The old credential is revoked only after verification passes.
The rotation sequence is: create new → verify new → revoke old. If verification fails, the new credential is revoked immediately and the old one remains active. The failure is recorded to the audit ledger. You are never left without a working credential. MDRwatchdog will not revoke an old credential until it has confirmed the new one is valid.
NIST recommends rotating credentials when they may have been compromised and on a periodic schedule. For API keys and tokens, 90 days is a common standard. MDRwatchdog Vault™ defaults to 90-day rotation and alerts when credentials are overdue. You can configure 30, 60, 90, 180, or 365-day rotation per credential.
The vault is an add-on to MDRwatchdog plans at $50/month per organization. It is not available as a standalone product — it is integrated into the MDRwatchdog console and its rotation events feed directly into the same quantum-resistant audit chain as your security detections. The combination of security monitoring + credential rotation evidence in one sealed ledger is the differentiator.
Your auditor can query your rotation history from the audit verification endpoint. They will see: which platform was rotated, the credential name, the rotation timestamp, whether verification passed, and the cryptographic seal (Ed25519 + ML-DSA-87 signature). This is tamper-evident, timestamped, and independently verifiable — the same chain as your security detections.
Plain-language answers to the questions buyers ask most — readiness and evidence, not certification or legal advice.
MDRwatchdog Vault™ rotates your API keys, seals the evidence, and hands your auditor cryptographic proof. Add it to any plan for $50/month.
Schedule your 15-minute review