Trust comes from accountability: the credentials vault (Zugangsdaten-Tresor) logs every action with who, when and why, without ever storing a secret in plaintext. This page covers what exactly is logged, where to find the log and what each role may do.
What gets logged
Each of these actions creates a log entry:
- Creating, editing and deleting an entry
- Revealing a secret, including the stated reason for entries on the sensitive level
- Sharing with the team, plus creating and revoking external links, including the mandatory reason
- Importing entries from CSV
- Setting up and deactivating vault 2FA
- Saving the team policies
- Filling a staff-logins template
Only metadata is stored: which person, which entry, which action, when, and the reason if one was given. Plaintext secrets never appear in the log. The reveal dialog says exactly that: Jeder Zugriff wird protokolliert (Wer, Wann, Warum). (every access is logged: who, when, why).
Where to find the log
The vault has no audit view of its own. All entries land in the central audit log of your workspace under Settings > Aktivität (activity, /settings/activity), together with the activity of every other tool. That view is reserved for owners and admins.
Webhook events
If you want to forward vault events into your own systems, you can subscribe to them per endpoint under Settings > Webhooks (/settings/webhooks). The vault emits these events:
| Event | Meaning |
|---|---|
credential.created | A new credentials entry was created. |
credential.updated | A credentials entry was changed. |
credential.deleted | A credentials entry was removed. |
credential.shared | An entry was shared with team members. |
credential.external_shared | An entry was shared via an external link. |
credential.revealed | A secret was revealed in plaintext. |
credential.imported | Credentials were imported. |
credential.template_provisioned | A staff-logins template was filled. |
Webhook payloads also contain metadata only, never the secret itself.
Roles and permissions
The platform knows the roles owner (Inhaber:in), admin, member (Mitglied) and viewer (Beobachter:in). In the table below they appear as Owner, Admin, Employee (= member) and External Viewer (= viewer). The owner always holds every right. "Scoped" means: only for entries you created or manage yourself.
| Aktion | Tenant-Owner | Tenant-Admin | Makler:in | Externer Viewer |
|---|---|---|---|---|
Open the vault See the tool and use the entry list. tools.use.credentials | ||||
See all shared entries Members otherwise only see their own entries plus what was shared with them. credentials.read.all | ||||
Create and import entries Create new entries, use the CSV import, fill staff-logins templates. credentials.create | ||||
Edit entries Members edit their own entries through the permanent creator grant. credentials.update | ||||
Delete entries (trash) credentials.delete | ||||
Share (internally and externally) Applies only to entries you manage yourself. credentials.share | ||||
Manage groups credentials.manage_groups | ||||
Save vault policies credentials.admin |
Further reading
How shares and external links work day to day is shown in Sharing. The mandatory reason when revealing sensitive entries is explained in Security. Back to the overview: Credentials vault.