Run KeyCare Pass on your own servers
Keep your organization's encrypted vault, files and logs on infrastructure you control. KeyCare Pass runs on a Docker host with PostgreSQL, behind your reverse proxy.
$ docker compose -p keycare -f deploy/docker/compose.yml \ --env-file /etc/keycare/keycare.env up -d --build ✔ Container keycare_db Healthy ✔ Container keycare_server Started $ docker logs -f keycare_server keycare: ready
Same apps, same encryption, your servers. The browser extension connects to your address instead of ours.
What you run
Two containers
keycare_server runs every KeyCare Pass service and the web vault; keycare_db is PostgreSQL 16.
Your reverse proxy
Your proxy terminates TLS for KeyCare Pass's hostname and forwards to the server container.
One settings file
Address, mail sender, database password, admin emails, storage limits and sign-up rules in an env file.
A license from GovPAM
Issued for your server's installation id, so organizations can be created without listing every creator.
Back up three things
The database, the state volume with keys and settings, and the attachments, together.
Open source
The server is AGPL-3.0 and the apps GPL-3.0; you can read every line you run.
How it works
Getting started
From package to first sign-in
Email [email protected] for the server package. Put your settings in an env file, start the stack with Docker Compose, and wait for "keycare: ready" in the log. Then point the browser extension at your address with the Self-hosted option on its sign-in screen.
Self-hosting in the help center$ docker compose -p keycare -f deploy/docker/compose.yml \ --env-file /etc/keycare/keycare.env up -d --build ✔ Container keycare_db Healthy ✔ Container keycare_server Started $ docker logs -f keycare_server keycare: ready
Frequently asked questions
What does a self-hosted license cost?
It depends on your organization. Ask us for a quote.
Does our server need to contact GovPAM?
No. A KeyCare Pass server never connects to a billing service; you upload a renewed license file before the old one expires.
Can we install the extension on managed computers?
Yes, with the ExtensionInstallForcelist policy. Networks that block the Chrome Web Store can use a signed package that updates from your own server. See the download page.
Try it with your own passwords
Create your account, then choose the plan that fits.