Skip to main content

Vaults

Admin Console → Vaults is the administrator's view of the workspace's vaults — who owns them, how many items and users each has, and what to do when the owner leaves.

Vaults

ColumnMeans
NameThe vault's name
ItemsHow many credentials it holds
UsersHow many people have access
CreatedWhen it was created

What an administrator can and cannot do here​

This is the screen where Robomotion's encryption model becomes visible as a limitation, so it is worth being direct about it.

You can:

  • Transfer ownership — reassign a vault whose owner has left.
  • Remove access — revoke a user's access to a vault.
  • Delete a vault — remove it and its items.
  • See orphaned vaults — vaults whose owner no longer exists in the workspace.

You cannot:

  • Read any item. Items are encrypted in the owner's browser under a key derived from their password. There is no server-side key, so there is nothing for an administrator to decrypt with.
  • Grant yourself or anyone else access. Access is granted by re-wrapping the vault key to the recipient's public key, which requires the vault key — which only someone who already has access holds. An administrator cannot manufacture it.

That second point is why this screen has no "grant access" action, and why the product explains its absence rather than leaving you looking for it. See Security Model for the mechanism.

Orphaned vaults​

When a user leaves, vaults they owned become orphaned, and there is exactly one way out:

Transfer ownership to someone who already has access. They hold the vault key, so the re-wrap can happen.

If nobody else ever had access, the items are gone. Not "gone pending a support ticket" — the only key that opened them was derived from the departed user's password, and no copy of it exists anywhere. Deleting the vault is then the only thing left to do with it.

Share vaults before you need to

A vault with two people on it never becomes orphaned, and sharing is free at creation time. Afterwards it is impossible: granting access means re-wrapping the vault key to the new person's public key, and that needs the vault key — which is precisely what nobody has any more.

This is the one piece of housekeeping on this page that cannot be done late.

Next​