Skip to main content
Securely store and manage customer credentials. Passwords are encrypted at rest with per-tenant encryption keys. Regentra checks your stored passwords against known breach lists and alerts you when a match is found.

​
What it does

  • Encrypted storage — Passwords are AES-256 encrypted at rest with per-organization keys
  • Secure sharing — Generate a one-time, self-destructing share link (optionally emailed, optionally PIN-protected) instead of pasting a password into chat or a ticket
  • Access control — Only team members with vault permissions can view passwords
  • Breach alerts — Regentra monitors stored passwords against known breach databases and alerts you on match
  • Audit trail — Every access to a password is logged for compliance
  • Three vaults — a per-client vault for each Company, an org-wide MSP Shared Vault for your own internal credentials, and a Personal Vault visible only to the technician who created it

​
How to manage passwords for a customer

1

Open the Password Vault

In the PSA module sidebar, click Passwords.
2

Select a company

Click a company card to view all stored passwords. Empty companies show an empty state.
3

Add a new password

Click Add Password. Enter a label (e.g. “Admin Account”, “Mail Server”), username, password, and optional URL or notes.
4

Create a share link

Click the password entry’s Share action to open Create Share Link. Choose a max view count (1/3/5/10), an expiry (1 hour up to 30 days), optionally an email address to send the link to, and optionally a 4-8 digit PIN. Click Create Link to get a one-time URL — the decryption key lives only in the URL fragment and is never sent to or stored on the server.

​
Security expectations

This vault is designed for MSP operational use: storing admin credentials, API keys, and service-account passwords your team needs to perform support work. It is not a password manager for end-users — don’t store employee or customer personal passwords here. Access control: Any authenticated team member with PSA access can view vault entries. Creating or editing a Company or MSP Shared Vault entry requires an admin-tier role (Admin, MSP Admin, or a compliance officer role); any authenticated user can create entries in their own Personal Vault. All actions are logged with timestamp, user, and action. Encryption: Passwords are encrypted using AES-256 with per-organization master keys. Decryption happens in-memory only when a user explicitly views the password. Encrypted payloads are never logged or exposed in APIs. Breach monitoring: Regentra continuously checks your stored passwords against publicly known breach databases. If a match is detected, an alert is generated in your dashboard and sent to vault admins. Reset the compromised credential immediately.

​
Linking credentials to networks

Entries in the vault can be linked to a subnet or VLAN in Networks — for example, the admin credential for a firewall or wireless controller. Rather than storing the secret again on the network record, you link out to the existing vault entry, so there’s one credential, one owner, and one audit trail no matter where it’s referenced from. When someone types something that looks like a password directly into a network’s notes, Regentra flags it and offers to move it into the vault instead.

​
Frequently asked questions

No. Passwords cannot be bulk-exported for security reasons. Copy them one at a time via the UI.
An alert is generated and sent to vault admins. The password is flagged in the UI as Breached. Reset it immediately. The alert remains visible until you acknowledge it.
Not yet. You can add a manual expiration note in the notes field. Automatic expiration alerts are on the roadmap.
Passwords are encrypted at rest. The connection is encrypted in transit (HTTPS). Once decrypted server-side and shown in your browser, security depends on your browser and device. Never copy passwords into insecure channels (email, Slack, etc.).