SparkVault in Slack, HubSpot and Salesforce

Your team shares Ingots and sends single-read secrets from Slack. In HubSpot and Salesforce, SparkVault Files keeps each record's files encrypted in a Vault you choose, and the file bytes never pass through the CRM.

SparkVault for Slack

Browse your Vaults, upload and organize Ingots, and share them to a channel, thread or person without leaving Slack. A share is a durable link or a one-time SparkLink, and you see who can open it and where it goes before it posts. /share_secret sends an expiring, single-read secret: the recipient confirms before opening it, and reading it burns the Spark.

Commands and shortcuts

/sparkvault: Browse your Vaults and Ingots. Add search words to find an Ingot by the start of its name.
/share_secret: Open the secret composer for this channel, or add @person or #channel to pick the recipient. A secret holds up to 3,000 characters and expires in 1 minute to 24 hours.
/secret: The same composer, with the same recipient options.
App Home: Browse without a command. A share starts in your direct messages with SparkVault, and you can pick a channel or a person instead.
Browse SparkVault: A shortcut that opens the same view of your Vaults.
Share from SparkVault: A shortcut on a message, for sharing an Ingot in its thread.

How you unlock a Vault

The first time, a SparkVault page asks you to sign in with Slack, then to the SparkVault account connected to the workspace. A link someone forwards to you does not connect.
On that page you unlock a Vault with your Vault Master Key (VMK) or a Delegated Vault Access Key (DVAK), for 1, 4, 8 or 24 hours. The key stays in browser memory unless you choose encrypted local storage with its own passphrase.
Back in Slack you browse, upload, rename, move, delete and share with your normal SparkVault permissions. Slack channel membership never grants SparkVault access on its own.

What Slack can see

Slack processes what you type into SparkVault's commands and dialogs, a secret once its recipient opens it, and the Vault and file names SparkVault shows there. A file you upload through Slack reaches Slack first, and Slack keeps its copy under your workspace's retention rules.

This integration is not end-to-end encryption that excludes Slack. Burning a Spark does not erase copies, screenshots or anything Slack has already processed. When something has to stay out of Slack, create and view it in SparkVault.

Slack never receives a Vault key. SparkVault never uploads an Ingot's contents to Slack, and a download goes from a SparkVault page straight to your browser.

Install

A SparkVault admin opens Integrations in SparkVault, selects "Add to Slack", picks the workspace and approves the permissions in Slack. Each person then connects their own SparkVault account the first time they use it. Invite SparkVault to a private channel before sharing there.

The app asks Slack for no channel message-history scope and no file-write scope, and keeps no Slack user token. Every scope it does request, and why, is in the Slack permissions table.

Install SparkVault for Slack Read the Slack setup guide

Built and supported by SparkVault. Contact support

SparkVault for HubSpot and Salesforce

Both put SparkVault Files on CRM records, and both work the same way underneath. The CRM draws the panel and never holds a copy of a file: the bytes travel directly between your browser and Forge, SparkVault's encryption and transfer service.

Encryption: Forge encrypts each file with AES-256-GCM, under keys derived from three master keys: SparkVault's, your account's and the Vault's own. Unsealing the Vault takes all three, which is what we call Triple Zero-Trust.
Storage: Each file is an Ingot in the Vault picked at install, in one folder per record.
Isolation: The panel lists only the viewed record's folder. A download or delete that names a file from another record is refused, even within your own CRM.
Access: Each person unseals the Vault with their own VMK or DVAK. The session lasts an hour, and one person's unseal never opens the Vault for anyone else.
Uploads: The panel's "Upload in SparkVault" button opens the record's folder in SparkVault, in a new tab. Download and delete work on the record itself.

CRM files
├─ Contacts/
│  └─ 501/
│     └─ id-verification.pdf
├─ Deals/
│  └─ 3307/
│     ├─ signed-msa.pdf
│     └─ security-review.pdf
└─ Tickets/
   └─ 118/
      └─ export.csv

A Vault connected to HubSpot, after uploads on three records. A record's first upload creates its folder, so a record with no files has none.

Where they differ

	HubSpot	Salesforce
Records	Contacts, Companies, Deals and Tickets	Accounts, Contacts, Opportunities and Cases
On the record	A SparkVault Files card in the sidebar, and a SparkVault tab	A SparkVault Files panel, a native Lightning component with no iframes
A record's folder	`Contacts/501`	`Accounts/001xx000003DGbzAAG`
Install	A SparkVault admin connects HubSpot over OAuth and picks the Vault	Managed package 1.8 in your org, then a SparkVault admin connects over OAuth and picks the Vault
Setup in the CRM	Customize a record page and add the SparkVault Files card	Place the panel in Lightning App Builder and assign the SparkVault User permission set
Asks the CRM for	Scopes that give the card its record's context, listed in the HubSpot scope table	Only `openid`, and SparkVault keeps no Salesforce access or refresh token
Your Vault key	Typed into the card, it reaches SparkVault in a request HubSpot signs and relays	Typed into the panel, it reaches SparkVault through the package's Apex controller and is discarded after unsealing
Each request	Signed by HubSpot, and refused by SparkVault when older than five minutes	Carries the person's Salesforce session, which SparkVault checks against your org and the record

Connect HubSpot or Salesforce Read the HubSpot setup guide Read the Salesforce setup guide

Built and supported by SparkVault. Contact support

Products are already on your account

Identity and Structured Ingots need no install and no OAuth. Every account can call their APIs.

See secure identity

Identity

An OpenID Connect (OIDC) identity provider with passkeys, magic links, social login and managed sessions.
Read the Identity docs
Structured Ingots

Encrypted key/value storage inside a Vault, with atomic operations and up to 10,000 keys per Ingot. A value comes back as a Spark you can read once.
Read the Structured Ingots docs

Build your own integration on the REST API

Entropy, Sparks, SparkLinks, Vaults and Ingots each have endpoints that take plain JSON over HTTPS, authenticated with an API key. This request seals a secret that burns the moment it is read. The response's data.spark_id is its one-time handle.

Read the API reference Create an API key

Create a Spark: POST /v1/sparks

curl https://api.sparkvault.com/v1/sparks \
  -H "X-API-Key: $SPARKVAULT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"payload": "the launch code is 793-alpha", "ttl_minutes": 60}'

Slack is a trademark of Slack Technologies, LLC. HubSpot is a trademark of HubSpot, Inc. Salesforce is a trademark of Salesforce, Inc. SparkVault is not affiliated with or endorsed by them.