From $2,500
Rotation without propagation is a new outage, not a fix.
This is for the firm that has done the responsible thing. You rotate keys. You have a password manager and a policy. And you have, somewhere, an automation that quietly stopped working after the last rotation because it was still holding the old value, and nobody noticed until a customer did. The problem is not that you failed to rotate. The problem is that nobody can tell you every place each credential is used, and nobody checks that a new value actually arrived at all of them. We build the ledger and the check, and attach it to your Care Plan so it keeps running after we leave.
What you get
The deliverables, stated plainly.
A credential ledger
Every API key, token, service password and certificate, where it is minted, who owns it, when it expires.
A consumer map per credential
Every application, automation, scheduled job and integration that holds a copy, so a rotation has a known list of destinations.
A weekly verifier
Exercises each consumer with the current value and reports which are live, stale or unreachable. Minted is not installed; the verifier proves installed.
A rotation runbook per credential
The order to update consumers, how to confirm each, how to roll back.
A monthly credential-debt report
Expiring, orphaned, over-shared, unverified.
Rotation-as-a-Service
As a Care Plan line: we run the rotations and the verifier for you.
How it runs
Week one is discovery. We get system access within 5 days of signing and inventory every credential we can find, including the ones in automation configs and the ones taped inside a vendor dashboard. Week two is the consumer map, built by tracing each credential to the things that use it and confirming with whoever set them up. Week three is the verifier: a scheduled check per consumer that proves the current value works where it lives. Week four is the runbooks and the first full rotation under supervision. You see every draft within 3 days of asking, and we hold a weekly check-in throughout. After acceptance, the verifier runs every week whether or not we are on retainer.
What it costs
Payment is 65% at signing and 35% on acceptance. The founder confirms the number on the call. Where the build includes an automation workflow, it carries our guarantee: one workflow automation that saves your team at least 10 hours per week, or 100% of the build fee back.
Why now
The lesson is ours and it is recent. In mid-2026 an email provider's API key was rotated, correctly and on schedule. The automation that used it kept the old value for four days because nobody verified the new one had reached every consumer. Outbound mail from that automation simply stopped. Nothing alarmed, because the rotation had succeeded; it was the propagation that had not. The security market sells rotation. Vaults, managers, scheduled rotation, every vendor has it. Nobody sells proof of propagation — the boring check that the new value is working everywhere the old one was. That gap is where the outage lives, and it is the gap this service closes.
Questions people ask
We already use a secrets manager. Why do we need this?
The manager knows what it minted. It does not know what a scheduled job on a forgotten server is holding. The consumer map is the part the manager cannot see; the verifier is the part it never checks.
How many credentials does a small firm actually have?
More than the owner guesses once automations, integrations and vendor portals are counted. The first inventory is the moment most clients understand the problem.
Is this a security product?
It is an operations product that reduces a security risk. Stale credentials in abandoned consumers are an exposure; unverified rotations are an outage. The monthly report is evidence you can hand an auditor or an insurer.
What happens when we rotate on our own?
The verifier tells you within a week which consumers did not get the new value. With the Care Plan line, we do the rotation and you get the confirmation instead of the surprise.
Book 15 minutes
The founder confirms the number on the call. Fifteen minutes, no deck, no pitch — we talk about your situation and tell you if there is nothing to build.