KeyVault Studio vs OSH

Azure Key Vault, without the portal: KeyVault Studio is the native client for Mac, iPhone and iPad. Your secrets, keys and certificates are well protected in Azure. Managing them just takes too many clicks in the portal. KeyVault Studio turns that into a real Apple app: fast, focused and secured with Face ID / Touch ID. Want to look around first? Demo mode opens the complete app with sample data, no Azure account needed. SECRETS ▸ Create, view, update and delete, every value behind Face ID / Touch ID ▸ Full version history with side-by-side comparison ▸ Content types for JSON, XML, connection strings and API keys ▸ The app warns before anything expires, with thresholds you choose ▸ Copied values clear themselves from the clipboard KEYS ▸ Create RSA, EC and HSM-backed keys ▸ Crypto Playground: encrypt, decrypt, sign, verify, wrap, unwrap ▸ Rotation policies and one-tap rotation ▸ Import from JSON Web Key CERTIFICATES ▸ Issue self-signed and CA-signed certificates ▸ Import PFX/P12 and PEM, export the public certificate or the private key ▸ Manage policies, issuers, contacts and pending operations NETWORKING ▸ Configure the vault firewall, VNet rules and private endpoints ▸ Manage private DNS zones, record sets and VNet links ▸ Approve or reject private endpoint connections VAULTS ▸ Find vaults across all your Subscriptions in seconds ▸ Create a new vault with a guided wizard ▸ Backup and restore, AES-GCM encrypted if you want ▸ Recover or purge soft-deleted vaults and items AI ASSISTANT ▸ Ask questions about your own infrastructure: what expires soon, what is disabled ▸ Runs fully on device if you want: Apple Intelligence or Gemma, no cloud required ▸ Or bring your own key: Claude, OpenAI, Gemini, plus Ollama on your own network ▸ Naming suggestions per Cloud Adoption Framework, subnet and address space planning ▸ The assistant sees names and metadata, never secret values ▸ A visible token budget keeps API costs under control BUILT FOR APPLE PLATFORMS ▸ Mac, iPhone and iPad with the same feature set, tuned per size class ▸ Lightning-fast search across every vault and item, right on the device ▸ Several accounts side by side: Azure Commercial, US Government and China clouds ▸ No middleman servers: the app talks directly to Azure with your Microsoft Entra ID sign-in Bring your own app registration or use the built-in one. Your secrets never leave your device except to Azure.

OSH turns your iPhone into a hardware-backed approver for zero-trust SSH access. Instead of long-lived SSH keys scattered across laptops, your team's gateway issues short-lived SSH certificates only after a human approves each request. OSH is where that approval happens — on a device you carry, protected by Face ID and the Secure Enclave. HOW IT WORKS • Enroll your device by scanning the gateway's QR code. • When someone requests SSH access, OSH shows you who, what, and where. • Approve or deny with Face ID. Your approval is signed by a key that lives only in the Secure Enclave. • The gateway issues a short-lived certificate — no standing keys, no shared secrets. WHY IT'S SECURE • The signing key is generated inside the Secure Enclave and is non-exportable — it can never leave your iPhone. • Every approval requires biometric authentication. • OSH connects only to the gateway you configure. It has no analytics, no trackers, no ads, and no third-party SDKs. FOR TEAMS • Role-aware: signers, admins, and root see the controls appropriate to them. • Review access rules, approval history, and gateway logs from the app. OSH requires a compatible zero-trust SSH gateway to connect to. If your organization doesn't run one yet, contact us at ad@openlay.com.