Personal entries are visible only to the person who created them. That is precisely why colleagues are willing to put their own logins in here at all. It is also why, on a Friday afternoon, nobody can get into the portal when that person is off sick. Emergency access solves exactly that without giving up the protection.
Why this path exists
Without a defined route, every office does the same thing: someone calls, someone reads the password out loud, it ends up in a chat message, and there it stays. That is the worst thing that can happen to a vault, and it happens exactly when the vault was supposed to help.
So emergency access is deliberately not a master key for administrators. Nobody gets it through a role or a permission. There is only one way it comes into existence: you name a person, and you give that person access to your own entries. That is also why setting it up needs no special permission. You are giving away something that is yours.
Setting it up
You find the area in the sidebar under Geteilte Links (shared links), at the bottom under Notfallzugriff (emergency access).
Pick a person
Choose a colleague from the workspace. You cannot pick yourself.
Set it up
One click is enough. From now on the person appears in your list marked bereit (ready). Nothing has happened yet: they still see none of your entries.
Tell them
The other person sees the entry on their side under Für dich hinterlegt (deposited for you). Tell them anyway. An emergency route nobody knows about is not one.
You can name several people. Setting it up again for the same person resets everything, including a request that is currently running.
How a request plays out
The named person clicks Anfordern (request) on their side. Three things then happen:
- You are notified immediately. The message lands in your inbox and names the person and the moment access would take effect.
- The waiting period starts. The default is 3 days; the workspace owner can set it anywhere between 24 hours and 14 days in the vault settings.
- Only then does access take effect. Until that point the requester still sees nothing.
The waiting period is the actual protection, not the nomination. Anyone requesting without cause first triggers a notification and then has to sit through days in which you can object. Anyone requesting with cause waits once and has access afterwards.
You can withdraw at any time, including in the middle of a running period: one click on Zurücknehmen (withdraw) in your list.
What emergency access opens, and what it does not
| Personal entries of the granting person | Yes, once the period has elapsed. |
| Shared team entries | Not needed here, those run through normal grants. |
| Hyper-sensitive entries | No. They are encrypted with that person's master password, which never leaves their browser. Emergency access cannot open them either. |
| Other people's entries | No. Access applies exactly to the person who set it up. |
Every access taken through this route appears in the access log, marked as having gone through emergency access. It is not covert, it is on the record.
When nobody is deposited
Then nobody can reach your personal entries, the workspace owner included. That is intended, and the vault says so on screen. If that feels too strict for a particular login, the answer is usually not emergency access but the visibility setting Geteilt (shared).
Four eyes on the highest level
A second special path, pointing the other way: emergency access is about making sure someone can get in at all. This is about making sure nobody gets in alone.
The owner can enable Höchste Stufe nur mit zweiter Person (highest level only with a second person) in the vault settings under Sicherheit. Opening a hyper-sensitive entry then works like this:
Request with a reason
Whoever wants to open the entry states a reason. The reason is mandatory and reaches the deciding person unchanged. An approval without a reason gets waved through, and then four eyes are just two with an extra step.
Approval by someone else
The request appears at the top of the Geteilte Links area for everyone entitled to decide. Nobody can approve their own request.
Open
After approval the entry can be opened. The request is valid for one hour: short enough that an approval does not sit open for days, long enough to ask a question across the office.
Request, reason and decision all go into the log. Rejections too.