# Credentials Vault {/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */} The **credentials vault (Zugangsdaten-Tresor)** is the encrypted home for every login your office relies on: portal accounts, API keys, PIN codes and secure notes. Instead of spreadsheets and sticky notes you get one central list with clear sharing rules, three confidentiality levels and a log of every access. ## What the vault is The credentials vault is a **standard tool** of the platform: it comes pre-installed on every plan and costs **no credits** (details: [Cost and availability](/tools/zugangsdaten-tresor/kosten)). You find it in your workspace at `/tools/credentials`. It has its own sidebar with every area: entries, folders, vault check, groups, personal entries, shared links, access log and trash. Every secret is encrypted before it is stored. Search only covers title, URL, username and tags, never the secret itself. Uninstalling the tool never deletes your data. ## What the vault can do Passwords, API keys, PIN codes and secure notes in one list. Each secret is encrypted before saving, and a built-in generator creates a strong password on demand. From standard to sensitive (revealing requires a reason) to hyper-sensitive: zero-knowledge encryption in your browser with a personal master password. Grant access per member, per role or per group. Shares always grant read access, and the creator of an entry always stays in control of it. Time-limited share links for outside partners (1 hour up to 7 days), revocable at any time, with every access counted and logged. Templates for services where each team member deposits their own login, with a progress indicator and optional escrow for the workspace owner. Who opened, copied or shared which entry, and the reason they gave. Visible on the entry itself and as a page of its own. Secrets never appear there. Finds weak and reused passwords, expired credentials, entries created by people who have left, and entries only one person can reach. Store a service's second factor and the vault shows the confirmation code right next to the password. No more reaching for the phone. Key-safe codes, WiFi and alarm systems can be attached to a property. They then also appear on the property page, where your colleague looks before a viewing anyway. ## The three confidentiality levels The vault's core concept: you decide per entry how strictly it is protected. Encrypted on the server. Revealing the secret needs no extra step but is always logged. The right level for everyday team logins. Like standard, but revealing requires you to state a reason (mandatory field). The reason goes into the audit log. A good fit for logins where your team wants to know why someone opened them. Encryption happens directly in your browser, protected by a personal master password. The server never sees the plaintext or the key. These entries cannot be shared externally. For hyper-sensitive entries there is no recovery without your master password, not even by the platform operator. If you lose the master password, those entries are permanently unreadable. Standard and sensitive entries are not affected. ## Getting started Open the **credentials vault** in your workspace at `/tools/credentials`. While the list is empty you will see the hint **Noch keine Einträge. Lege deinen ersten Zugang an.** (no entries yet, create your first login). Click **Neuer Eintrag** (new entry). Give it a title (for example "ImmoScout24 office account"), pick the type and enter the secret. For the password type you must also fill in an email or a username. Decide whether the entry is **Geteilt (Team)** (shared with the team) or **Persönlich** (personal), and pick a confidentiality level. Rule of thumb: standard for team logins, personal only for accounts that are truly yours alone. After saving, the entry appears in the list. Use **Teilen** (share) to grant read access to specific members, roles or groups. You do not have to start from scratch: the **Import** dialog reads CSV files from browsers, 1Password, Bitwarden or Excel. The file is only read inside your browser. Details: [Managing entries](/tools/zugangsdaten-tresor/eintraege#import-from-csv). ## All topics in detail List and search, creating and editing entries, all field types, revealing with logging, deleting and CSV import. The three confidentiality levels in detail, the master password for zero-knowledge, vault 2FA and the team policies. Team shares (members, roles, groups), personal vs. shared entries and external share links with expiry and revocation. Templates for services where everyone deposits their own login, including escrow and the progress indicator. What gets logged, which webhook events exist and what each role may do in the vault. What the check finds, how to read the access log, how the trash works and what to do when someone leaves. Name a person you trust who can take over your personal credentials in an emergency, with a waiting period and the right to object. Why the vault costs no credits, what every plan includes and how storage is counted. Visibility, how entries are protected, automatic locking, moving over via CSV and offboarding. Answers to the most common issues: forgotten master password, 2FA codes, invisible entries, import duplicates. ## Frequently asked questions Who sees what, how entries are protected, what happens when someone leaves the office and how to move over from another password manager: [Questions and answers](/tools/zugangsdaten-tresor/faq).