What Team and Business Features Does Yopass Offer for Secure Secret Workflows?

Yopass's team and business features are bundled in a paid Business License (€149/year, self-hosted) and cover four areas: Secret Requests to collect credentials from outside parties, Read Receipts and Webhooks to know when a secret is opened, OpenID Connect sign-in to put secret creation behind single sign-on, and Audit Logs that record security events without exposing secret contents. These features are for organizations that already use Yopass or plan to self-host it and need governance over how credentials move in and out of the team. The open-source edition remains free to self-host but does not include them.

Secret Requests: Collecting Credentials From People Outside Yopass

Secret Requests reverse the usual flow. Instead of you creating a secret and sending a link, you send a request link to a vendor or client who doesn't use Yopass. They upload the secret through that link, and you receive it encrypted.

This matters when the other party has no account, no self-hosted instance, and no reason to learn a new tool. The request link is the only thing they interact with, and the secret still arrives encrypted rather than sitting in an email thread or a shared document.

Use it when:

• Onboarding a vendor who needs to hand over API credentials
• Receiving account details from a client during a project handoff
• Collecting any credential from someone outside your organization's identity system

Read Receipts and Webhooks: Knowing When a Secret Is Opened

A one-time link is only useful if you know whether it was actually used. Yopass's business tier adds:

• Read Receipts — notification by email or webhook the moment a one-time link is decrypted, so you know exactly when a secret is opened.
• Webhooks — push security events into your SOC or dev workflows, triggering automated actions when secrets are created, requested, or accessed.

The practical difference: with read receipts, "I sent it" becomes "they opened it at 14:32." With webhooks, that event can flow into an existing alerting or ticketing pipeline instead of requiring someone to check a dashboard.

OpenID Connect Sign-In: Putting Secret Creation Behind SSO

OpenID Connect sign-in requires users to authenticate through your OIDC provider before they can create a secret. This turns secret sharing from an open capability into an action tied to a known identity.

It fits organizations that already run an identity provider and want secret creation to follow the same access rules as other internal tools — no separate credentials, no anonymous creation. Note that this governs creation; the page describes it as putting secret creation behind single sign-on, so plan your rollout around who needs to create versus who only receives links.

Audit Logs: A Record Without the Secret

Audit logs record security-relevant events — secret creation, access, and deletion — without exposing the secret contents. The page shows the shape of an event:

2026-06-17T14:32:01Z secret.created
{"outcome":"success","user_email":"[email protected]","client_ip":"203.0.113.42","secret_id":"e065107b78ac","one_time":true}

You get who created it, from which IP, which secret ID, and whether it was one-time — but not the password or key itself. That is the point: the log is safe to retain and review, and it gives you a clear audit trail across the organization.

What the Business License Adds Beyond Governance

The Business License is €149/year, self-hosted, and includes everything in the open-source edition plus:

Both editions run on your own infrastructure — the page frames self-hosting as what makes the setup "truly secure," and the business tier does not move you to a hosted service.

How to Decide

• Choose open source if you need encrypted one-time links and file sharing for a small team and handle governance informally.
• Choose the Business License if you must collect credentials from outside parties (Secret Requests), prove when a secret was opened (read receipts/webhooks), tie creation to SSO (OIDC), or keep an audit trail for compliance — and you are willing to run it on your own infrastructure.
• Check before committing: the page lists "higher upload size" for the business tier but does not state the exact limit, and it does not detail per-seat pricing or user-count limits. Confirm those with the vendor if upload size or team size is a deciding factor.

A reasonable rollout: start with the free self-hosted edition to validate your deployment (Docker/Kubernetes plus Redis or Memcached), then add the Business License when you need to bring vendors or clients into the workflow or require SSO and audit records.