# Staff logins: templates for personal service accounts

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
Many services in a brokerage come with one login per person: the portal account, the CRM, the mailbox. **Mitarbeiter-Zugänge** (staff logins) are templates for exactly that: you define the service once, and every team member deposits their own login for it. Progress stays visible without anyone having to see other people's passwords.
</Lead>

## What templates are for

The header button **Mitarbeiter-Zugänge** opens the dialog **Mitarbeiter-Zugänge (Vorlagen)** (staff logins, templates), which the credentials vault (Zugangsdaten-Tresor) describes as **Dienste, bei denen jede:r den eigenen Zugang hinterlegt** (services where everyone deposits their own login). The difference to normal sharing:

- With [sharing](/tools/zugangsdaten-tresor/teilen) there is **one** entry that several people read.
- With a template there is **one entry per person**, created by that person themselves.

Typical cases: personal ImmoScout24 accounts, individual CRM logins, per-person access to valuation tools. While nothing exists yet, the dialog shows **Noch keine Vorlagen.** (no templates yet).

## Creating a template

Templates can be created by anyone who manages vault entries (admins and the workspace owner by default). Fill in these fields and confirm with **Vorlage anlegen** (create template):

<DefinitionList>
  <DefItem term="Service (Dienst)">
    The name of the service; the field suggests **Dienst (z.B. ImmoScout24 persönlich)** (service, e.g. personal ImmoScout24). All members see the template under this name.
  </DefItem>
  <DefItem term="Login URL">
    The sign-in page of the service. It is carried over into the deposited logins.
  </DefItem>
  <DefItem term="Note (Hinweis)">
    Free text for your team, for example "please use the account registered to the office address".
  </DefItem>
  <DefItem term="Fields (Felder)">
    Which details members should deposit: **Username**, **E-Mail** and/or **Passwort** (password).
  </DefItem>
  <DefItem term="Confidentiality (Vertraulichkeit)">
    The confidentiality level used for the deposited logins (see [Security](/tools/zugangsdaten-tresor/sicherheit)).
  </DefItem>
  <DefItem term="Inhaber darf Zugänge sehen (Escrow)">
    The escrow checkbox, see the next section.
  </DefItem>
</DefinitionList>

## Escrow: who can see the logins

The checkbox **Inhaber darf Zugänge sehen (Escrow)** (owner may see logins) decides what happens with the deposited logins:

<DefinitionList>
  <DefItem term="Escrow on">
    The workspace owner can view the deposited logins. Sensible for accounts that belong to the office: if someone leaves the team, the login stays reachable for the business. The progress line then shows **Escrow an** (escrow on).
  </DefItem>
  <DefItem term="Escrow off (private)">
    Each deposited login stays private with the person who created it. The vault only records **that** something was deposited, not **what**. The progress line shows **privat** (private).
  </DefItem>
</DefinitionList>

<Tip title="Communicate the escrow status up front">
The escrow status is visible to everyone in the template's progress line. Still, tell your team beforehand which mode applies: with escrow on, these are office accounts, not private passwords.
</Tip>

## Depositing your own login as a member

Every member opens the same **Mitarbeiter-Zugänge** dialog and sees all templates:

<Steps>
  <Step title="Open the template">
    For a template you have not filled yet, the button **Meinen Zugang hinterlegen** (deposit my login) is available; your status shows **Noch offen** (still open).
  </Step>
  <Step title="Enter your own details">
    Fill in the fields defined by the template (username, email, password) with your own account details. The vault stores a regular encrypted entry on the configured confidentiality level.
  </Step>
  <Step title="Update later">
    Once deposited, your status shows **Du hast deinen Zugang hinterlegt** (you have deposited your login). Use **Meinen Zugang bearbeiten** (edit my login) and **Aktualisieren** (update) to record changes, for example after a password rotation.
  </Step>
</Steps>

## Keeping an eye on progress

Every template shows a progress line in the format **{x}/{y} Mitarbeiter eingerichtet · Escrow an** or **· privat** (x of y staff set up, escrow on or private). You see at a glance who has already deposited their login, without looking into anyone's entries. That also makes templates a handy onboarding checklist for new colleagues.

## Deleting a template

When deleting, the dialog asks **Vorlage löschen?** (delete template?) and clarifies: **Bereits hinterlegte Mitarbeiter-Zugänge bleiben bestehen.** (logins already deposited are kept). Only the template itself disappears; the entries created by members remain untouched in the vault.

## Further reading

How the deposited entries are protected is explained in [Security](/tools/zugangsdaten-tresor/sicherheit). Whether filling a template is logged (yes, it is) is covered in [Audit and permissions](/tools/zugangsdaten-tresor/audit-und-berechtigungen). Back to the overview: [Credentials vault](/tools/zugangsdaten-tresor).