IBM Cloud Secrets Manager is a single-tenant secrets management service built on HashiCorp Vault. The service provides centralized lifecycle management for various types of secrets including API keys, credentials, certificates, and arbitrary text values. The service operates in a dedicated instance environment, offering data isolation while maintaining public cloud benefits. It supports dynamic secret generation with configurable lease periods and access control from a centralized location. Key capabilities include certificate management with support for SSL, TLS, PKI, and integration with Let's Encrypt certificate authority. The service can create private keys and certificate signing requests (CSRs) for imported certificates. Certificate management is backed by Hardware Security Module (HSM) protection. The platform includes secrets groups for managing access policies at scale, and a locking mechanism to prevent deletion or modification of secrets while in use. It supports auto-rotation of secrets and integrates with IBM Cloud Activity Tracker for audit logging and monitoring. The service offers integration with IBM Key Protect for encryption of secrets at rest (BYOK). It provides a dashboard interface for managing multiple secret types and supports custom credentials through Code Engine job implementations. Compliance certifications include ISO 27k, SOC, PCI-DSS, GDPR, ISMAP, C5, ENS High, and IBM Cloud Framework for Financial Services. The service is configured with unique Secret Engines and an IAM Auth Engine, built for high availability with failover across three regional data centers.