When enabled, the connection strings and passwords usually visible as plain text in the configuration file are encrypted. The excerpt below shows how the information is replaced with a $$vault$$ placeholder; this information is encrypted/decrypted implicitly, when required at run time.
MFDBFH_VAULT=<vault-name>
dbfhconfig -vault -file:<file-name>
<datastores usevault="true">
<server name="localhost:50000" type="db2" access="odbc">
<dsn name="DB2.VSAM" type="datastore" dsname="VSAM" optio="none +ooseq" dbname="MYMFFILS" connect="$$vault$$"/>
</server>
</datastores>