Protects API keys, passwords, certificates, encryption keys, and machine credentials through vaults, rotation, scoped access, auditing, and emergency recovery.