> ## Documentation Index
> Fetch the complete documentation index at: https://docs.regentra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Password Vault

> Encrypted storage for customer credentials with breach monitoring, controlled sharing, and full audit trail.

Securely store and manage customer credentials. Passwords are encrypted at rest with per-tenant encryption keys. Regentra checks your stored passwords against known breach lists and alerts you when a match is found.

## What it does

* **Encrypted storage** — Passwords are AES-256 encrypted at rest with per-organization keys
* **Secure sharing** — Share credentials with team members without exposing the password in chat or logs
* **Access control** — Only team members with vault permissions can view passwords
* **Breach alerts** — Regentra monitors stored passwords against known breach databases and alerts you on match
* **Audit trail** — Every access to a password is logged for compliance
* **Per-client scoping** — Passwords are organized by [Company](/psa/companies-contacts) for easy discovery

## How to manage passwords for a customer

<Steps>
  <Step title="Open the Password Vault">
    In the PSA module sidebar, click **Passwords**.
  </Step>

  <Step title="Select a company">
    Click a company card to view all stored passwords. Empty companies show an empty state.
  </Step>

  <Step title="Add a new password">
    Click **Add Password**. Enter a label (e.g. "Admin Account", "Mail Server"), username, password, and optional URL or notes.
  </Step>

  <Step title="Share with a technician">
    Click the password entry. **Share** opens a modal where you grant temporary or permanent access to a specific team member.
  </Step>

  <Step title="Revoke access">
    On the password detail page, click **Revoke** next to a name to remove their access immediately.
  </Step>
</Steps>

## Security expectations

This vault is designed for MSP operational use: storing admin credentials, API keys, and service-account passwords your team needs to perform support work. **It is not a password manager for end-users** — don't store employee or customer personal passwords here.

**Access control:** Only authenticated team members with the Vault Admin or Vault User role can view or share passwords. All actions are logged with timestamp, user, and action (view, share, revoke).

**Encryption:** Passwords are encrypted using AES-256 with per-organization master keys. Decryption happens in-memory only when a user explicitly views the password. Encrypted payloads are never logged or exposed in APIs.

**Breach monitoring:** Regentra continuously checks your stored passwords against publicly known breach databases. If a match is detected, an alert is generated in your dashboard and sent to vault admins. Reset the compromised credential immediately.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I export passwords from the vault?">
    No. Passwords cannot be bulk-exported for security reasons. Copy them one at a time via the UI.
  </Accordion>

  <Accordion title="What happens if a password is found in a breach database?">
    An alert is generated and sent to vault admins. The password is flagged in the UI as **Breached**. Reset it immediately. The alert remains visible until you acknowledge it.
  </Accordion>

  <Accordion title="Can I set an expiration date on a password?">
    Not yet. You can add a manual expiration note in the notes field. Automatic expiration alerts are on the roadmap.
  </Accordion>

  <Accordion title="Is the vault end-to-end encrypted?">
    Passwords are encrypted at rest. The connection is encrypted in transit (HTTPS). Once decrypted server-side and shown in your browser, security depends on your browser and device. Never copy passwords into insecure channels (email, Slack, etc.).
  </Accordion>
</AccordionGroup>