# Emergency access and four-eyes approval

{/* AUTO-SYNCED SOURCE: this page lives in apps/app/src/modules/credentials/docs/ and is mirrored into the docs app by `bun sync:module-docs`. Edit it in the module, not in apps/docs. */}
<Lead>
Personal entries are visible only to the person who created them. That is precisely why colleagues are willing to put their own logins in here at all. It is also why, on a Friday afternoon, nobody can get into the portal when that person is off sick. **Emergency access** solves exactly that without giving up the protection.
</Lead>

## Why this path exists

Without a defined route, every office does the same thing: someone calls, someone reads the password out loud, it ends up in a chat message, and there it stays. That is the worst thing that can happen to a vault, and it happens exactly when the vault was supposed to help.

So emergency access is deliberately **not a master key for administrators**. Nobody gets it through a role or a permission. There is only one way it comes into existence: you name a person, and you give that person access to your own entries. That is also why setting it up needs no special permission. You are giving away something that is yours.

## Setting it up

You find the area in the sidebar under **Geteilte Links** (shared links), at the bottom under **Notfallzugriff** (emergency access).

<Steps>
  <Step title="Pick a person">
    Choose a colleague from the workspace. You cannot pick yourself.
  </Step>
  <Step title="Set it up">
    One click is enough. From now on the person appears in your list marked **bereit** (ready). Nothing has happened yet: they still see none of your entries.
  </Step>
  <Step title="Tell them">
    The other person sees the entry on their side under **Für dich hinterlegt** (deposited for you). Tell them anyway. An emergency route nobody knows about is not one.
  </Step>
</Steps>

You can name several people. Setting it up again for the same person resets everything, including a request that is currently running.

## How a request plays out

The named person clicks **Anfordern** (request) on their side. Three things then happen:

1. **You are notified immediately.** The message lands in your inbox and names the person and the moment access would take effect.
2. **The waiting period starts.** The default is 3 days; the workspace owner can set it anywhere between 24 hours and 14 days in the vault settings.
3. **Only then does access take effect.** Until that point the requester still sees nothing.

**The waiting period is the actual protection, not the nomination.** Anyone requesting without cause first triggers a notification and then has to sit through days in which you can object. Anyone requesting with cause waits once and has access afterwards.

You can withdraw at any time, including in the middle of a running period: one click on **Zurücknehmen** (withdraw) in your list.

<Callout tone="info">
If the notification cannot be delivered, the request fails. That is intentional: a waiting period you never hear about is not a period, only a delay.
</Callout>

## What emergency access opens, and what it does not

| | |
|---|---|
| **Personal entries of the granting person** | Yes, once the period has elapsed. |
| **Shared team entries** | Not needed here, those run through normal grants. |
| **Hyper-sensitive entries** | No. They are encrypted with that person's master password, which never leaves their browser. Emergency access cannot open them either. |
| **Other people's entries** | No. Access applies exactly to the person who set it up. |

<Callout tone="warning">
There is no emergency route for hyper-sensitive entries. That is not a gap, it is the point of that level. If a login keeps the office running, it does not belong there, it belongs in a shared entry.
</Callout>

Every access taken through this route appears in the access log, marked as having gone through emergency access. It is not covert, it is on the record.

## When nobody is deposited

Then nobody can reach your personal entries, the workspace owner included. That is intended, and the vault says so on screen. If that feels too strict for a particular login, the answer is usually not emergency access but the visibility setting **Geteilt** (shared).

## Four eyes on the highest level

A second special path, pointing the other way: emergency access is about making sure someone can get in at all. This is about making sure nobody gets in alone.

The owner can enable **Höchste Stufe nur mit zweiter Person** (highest level only with a second person) in the vault settings under **Sicherheit**. Opening a hyper-sensitive entry then works like this:

<Steps>
  <Step title="Request with a reason">
    Whoever wants to open the entry states a reason. The reason is mandatory and reaches the deciding person unchanged. An approval without a reason gets waved through, and then four eyes are just two with an extra step.
  </Step>
  <Step title="Approval by someone else">
    The request appears at the top of the **Geteilte Links** area for everyone entitled to decide. Nobody can approve their own request.
  </Step>
  <Step title="Open">
    After approval the entry can be opened. The request is valid for one hour: short enough that an approval does not sit open for days, long enough to ask a question across the office.
  </Step>
</Steps>

Request, reason and decision all go into the log. Rejections too.

## Frequently asked questions

<Faq>
  <FaqItem q="Does my trusted person see my entries before requesting?">
    No. Until they request, and until the period has elapsed, they see nothing. They only see that the emergency access exists.
  </FaqItem>
  <FaqItem q="Can the workspace owner grant themselves emergency access?">
    No. It can only ever be set up by the person whose own entries are at stake. Anything else would be a master key under a different name.
  </FaqItem>
  <FaqItem q="What happens when I leave the office?">
    A deposited emergency access stays in place as long as your account exists in the workspace. For an orderly handover the right route is still the <strong>Beim Ausscheiden einer Person</strong> (when someone leaves) area in the vault check, because that also tells you which credentials need changing.
  </FaqItem>
  <FaqItem q="Why can the waiting period not be set to zero?">
    Because the period is the protection. Without it, emergency access would just be a grant with a more dramatic name. The shortest setting is 24 hours.
  </FaqItem>
  <FaqItem q="Is a request I withdraw recorded anywhere?">
    Yes. Requesting, withdrawing and every later access appear in the access log and in the workspace audit log.
  </FaqItem>
</Faq>