Frequently asked questions

Can I open my vault in this website?

No. This is a static information, documentation, and download site. Vault access takes place in the installed client. The website does not collect master passwords or process your vault.

Which platforms work today?

Windows is the built and tested client. Android and iPhone app sources now include shared vault workflows and native integration; platform validation and store releases are pending. System autofill is not implemented yet. Check Downloads for actual release availability.

Do I need a new master password for every server?

No. You keep one portable identity. Each server separately enrolls the device and applies its own access policies and MFA. Organizations also unlock separately.

Does personal sync need an organization?

No. Personal sync uses a server in Public mode and can run independently of organization membership. Configure your own HTTPS server today; the default hosted personal service has not launched. Local-only storage remains an option.

Why is my organization still locked after I sign in?

Server sign-in discovers memberships. Local identity unlock opens the identity. Neither opens an organization's separate session. Select that organization and unlock with its authenticator code or enrolled Windows Hello credential.

I joined an organization. Why are its records missing?

Membership does not deliver record keys. A custodian must share a record or group with you, then you accept its encrypted offer in Invitations. Also check that you selected and unlocked the correct workspace.

What does a green member badge mean?

An owner verified the member's Identity ID and approved their locked organization names. It is a name-to-identity assurance from that owner, not proof that the device is safe. Continue checking the full Identity ID when a decision is sensitive.

Does sharing a group include subgroups?

It includes inheriting subgroups, records, and future children. Restricted groups need independent access. Sharing a single record does not share its siblings.

Why does HTTPS connection checking fail?

The server needs a certificate trusted by the client and valid for the exact hostname. A self-signed or mismatched certificate can cause a handshake failure. Configure trusted TLS and the correct public origin; do not bypass certificate verification for a production installation.

Can an administrator reset my password and read my vault?

An administrator role does not supply your decryption keys. Identity recovery uses your saved encrypted backup and separate recovery key. Organization recovery requires previously accepted cryptographic custody for the covered resources.

What if I lose my only device?

Restore from the encrypted backup and its separate recovery key, then enroll the new device with your servers. A server account alone is not enough to reconstruct missing client secrets. Keep recovery materials and organization custody ready before device loss.

Does blocking someone make previously shared passwords safe again?

Blocking ends permitted access and queues affected key changes. It cannot remove copied plaintext. Replace exposed credentials at their original service and track that work in the incident.