Vault stores all the secrets in memory.

It uses the mlock capability of the kernel to prevent swapping.

When the app restarts or the server restarts, it must be unsealed using the keys that were generated during setup.

This is by Vault design.