SecretWolf
Frequently asked questions
The short answers. For how it's secured see security, for plans and limits see pricing, for how your team signs in see single sign-on, and for the API see the API docs.
What is SecretWolf?
SecretWolf sends and requests secrets — passwords, API keys, files — as one-time, encrypted links under your own brand. The link is destroyed the moment it's read, and every send and view is recorded in a metadata-only audit trail.
How does a one-time link work?
You paste or generate a secret and it's encrypted before it's stored. The recipient opens the link and sees it once; on view, or at expiry, the ciphertext is hard-deleted. There's nothing left to leak from an old message or inbox.
Is SecretWolf a password manager?
No. A password manager stores your team's credentials for the long term. SecretWolf is for the handover — passing a secret to someone once, with proof it happened. The two sit happily side by side.
What's included on the free plan?
The Free plan is one user with up to three active secrets, seven-day expiry, secret templates, QR codes and the built-in password generator — no card required. Three active means three live at once, not three ever: a secret stops counting once it's viewed or expires. Branding, requests and the audit trail arrive on Team and Business.
Can I send files, not just text?
Yes, on the Business plan. Attachments are capped at 10 MB, restricted by type, scanned for malware, encrypted at rest, and deleted on the same view-or-expiry rules as the secret.
Does SecretWolf have an API?
Yes. The Business plan includes API keys and a small API to create secrets and requests and query the audit log, plus HMAC-signed outbound webhooks when a secret is viewed or a request is fulfilled.
What happens when a link expires?
Expiry is a hard delete: the secret payload and any attachments are removed, and the audit log records the expiry event. An expired link simply shows that it's no longer available.
Can I stop a secret before it's opened?
Yes. You can revoke a secret before it's viewed, and set multi-view limits — a number of views within a window — where a single view isn't enough.
Where is my data hosted?
On UK infrastructure, over HTTPS end to end. Secret content is encrypted at rest and hard-deleted on view or expiry; the audit log holds metadata only.
Can my team sign in with Microsoft or Google?
Yes, on the Business plan. SecretWolf connects to Microsoft Entra ID or Google Workspace over OpenID Connect, so your team signs in with the work account they already have and your identity provider handles multi-factor authentication. An owner can make it the only way members sign in, and owners keep a password route so a broken identity provider cannot lock the workspace out. There is no SCIM: accounts are not synced from your directory, though new people from email domains you allow can be given a member account on first sign-in.
How much does SecretWolf cost?
Free to start, then Team at £12 a month for up to five users and Business at £29 a month for up to fifteen. One price per workspace, billed monthly, excluding VAT.