GuideAccount & SecurityVault & Account
Account & Security

Vault & Account

The Vault is the one place in Shipmark built to be invisible to everyone but you — including your own teammates and Shipmark itself. This page also covers the beta and account security.

Your vault stays yours

Why "AES-256 encrypted" actually means something here, step by step.

Encrypted in your browser

Before anything ever leaves your device.

Only ciphertext reaches the server

Shipmark stores it, never reads it.

You hold the only key

Derived from your vault PIN, never sent anywhere.

Invisible to everyone else

Not teammates, not managers, not Shipmark.

Using the Vault

AES-256 encrypted, and private to you alone.

Why it exists

Freelancers and developers end up holding client credentials, API keys, and access tokens somewhere. The Vault keeps them encrypted in your browser before they ever reach Shipmark's servers.

When to use it

Any password, credential, link, or private note you need to keep but shouldn't leave lying around in chat or a shared doc.

  1. 1

    Open the Vault

    From the sidebar — unlock it with your vault PIN.

  2. 2

    Add an item

    Password, link, or note, encrypted in your browser before it's ever sent.

  3. 3

    Pin frequently used entries

    For one-tap access without scrolling.

  4. 4

    Bulk import

    From an existing password manager, if you're moving over.

web.shipmark.app/vault
Vault
AES-256 encrypted
Production DB password••••••••
Client staging server URL••••••••
API rotation checklist••••••••
Only you can decrypt these — never visible to teammates or Shipmark

Pro Tip

Vault items are private to your own account — not visible to managers, teammates, or anyone else in your workspace.

Pro Tip

The server only ever stores ciphertext — Shipmark itself cannot decrypt what you store, even if asked to.

Two-Factor Authentication

An authenticator-app code on top of your password or email code.

Why it exists

A password or email code alone is one factor. Adding a second, time-based code from an app you already control makes an account far harder to take over, even if the first factor ever leaks.

When to use it

Any account you'd rather not lose access to — recommended for anyone signing in with a password or email code.

  1. 1

    Open Profile → Security

    Scan the QR code with any authenticator app — Google Authenticator, Authy, 1Password, and similar all work.

  2. 2

    Confirm with a live code

    Enter the 6-digit code your app just generated to turn it on.

  3. 3

    Save your recovery codes

    Ten single-use codes, shown once — the only way back in if you ever lose your device.

  4. 4

    Sign in as usual, then enter your code

    Password or email code first, then the second step — same for both.

Pro Tip

A recovery code works even if your authenticator app is unreachable — store the set somewhere safe outside the app itself.

Pro Tip

Signing in with Google skips this step entirely — Google's own sign-in is already treated as a strong, independent credential.

MCP Integration

Connect Claude Code, Claude Desktop, or Cursor to your workspace.

Why it exists

A lot of daily work already happens inside an AI coding assistant. MCP lets that assistant create tasks, log work, and update checklist steps directly, instead of you copying updates over by hand.

When to use it

Any time you want to log work or manage tasks from Claude Code, Claude Desktop, Cursor, or another MCP-compatible client, without switching to the browser.

  1. 1

    Open Profile → API Tokens

    Generate a personal token — it's shown once, so save it somewhere safe.

  2. 2

    Connect your client

    One CLI snippet on the same page configures Claude Code, Claude Desktop, or Cursor to use it — no manual server setup.

  3. 3

    Use it from your assistant

    Ask it to log work, create or update a task, or add a checklist step, and it happens directly in your workspace.

Pro Tip

Every action taken through MCP passes the exact same workspace, project-access, and plan-limit checks as if you'd done it yourself in the app — there's no special trust given to AI-initiated changes.

Pro Tip

Revoke a token from Profile at any time — it takes effect immediately.

The Beta

Everything is free right now — no billing, no upgrading.

Why it exists

Shipmark is in a free beta, so every feature is available to everyone at no cost, with nothing to upgrade and nothing billed.

When to use it

For the whole beta period — there's nothing to set up or manage.

Pro Tip

Pricing may be introduced in the future once the beta ends, but nothing about that is active or billed today.

Best practices

  • Choose a vault PIN you don't use anywhere else — it's the only thing standing between ciphertext and your actual data.
  • Pin the handful of items you reach for constantly, rather than scrolling the full list each time.
  • There are no plan limits to plan around during the beta — everything is available from day one.

Frequently asked questions

No. Vault items are private to your own account only — this is true regardless of your role or anyone else's in the workspace.
Because encryption happens client-side and Shipmark never sees your PIN or the decrypted contents, losing it means losing access to that data the same way losing a master password would with any zero-knowledge system. Choose one you can reliably recall.
Shipmark is currently free for everyone during the beta — there's no trial clock and no plan to compare against right now.
No extra step is needed there — signing in with Google is already treated as a strong, independent credential, so two-factor authentication only ever applies on top of a password or email-code sign-in.
No. MCP tokens act on your behalf and are checked against the same workspace, project-access, and plan-limit rules as your own account — nothing extra is unlocked by connecting a client.

Need more help?

Can't find what you're looking for here — try these.