ReleaseHub has an encrypted secrets at rest solution built-in, but can support vault or secrets manager if an organization is already using that.