Skip to main content

Corporate Password Security & Password Managers

If company passwords for bank portals, cloud hosting, and social media accounts are stored in spreadsheets, text notes, or personal Telegram chats, your business faces substantial security risks.

At 1it.pro, we implement password management standards that protect against credential leaks while remaining seamless for everyday staff workflows.

Why Spreadsheets & Messengers Fail​

  1. Zero Encryption: Spreadsheets and chat notes can be copied to personal drives, shared inadvertently, or leaked through device theft.
  2. No Role Separation: Sharing a master sheet grants every employee visibility into sensitive credentials they do not need.
  3. Chaotic Offboarding: When an employee leaves, you have no record of which passwords they copied or saved locally.

Enterprise Password Management: Vaultwarden​

We recommend and deploy Vaultwarden (a high-performance, lightweight implementation of Bitwarden) hosted directly on your dedicated infrastructure:

  • Complete Data Sovereignty (GDPR): Your encrypted password vault resides on your own European server rather than a public shared cloud.
  • Cross-Platform Convenience: Native apps and browser extensions for Windows, macOS, Linux, iOS, and Android.
  • Integrated Two-Factor Authentication: Built-in TOTP authenticator token generation.

Organizing Access via Collections​

Access should be structured by organizational department:

  • 📂 Marketing: Social media accounts, advertising dashboards, analytics tools.
  • 📂 Operations & CRM: Daily CRM access, scheduling tools, support email inboxes.
  • 📂 Finance & Accounting: Bank portals, tax platforms, accounting software (accessible only by Owner & Accountant).
  • 📂 Administration: Master domain registrar, hosting root accounts (accessible only by Owner).

The Offboarding Reality: What Actually Happens When Staff Depart​

Revoking Vault Access Is Only Step 1

A critical security misconception is assuming that disabling an employee's Vaultwarden account instantly cuts off their access to external tools:

  • What Revocation Does: It immediately prevents the employee from viewing or copying credentials stored in your vault.
  • What Revocation DOES NOT Do: It does NOT terminate active browser sessions or cookies on the employee's phone or home laptop for third-party platforms (like Instagram, Google Ads, or SaaS tools) where they were already logged in.
  • Complete Offboarding Protocol:
    1. Deactivate the employee's Vaultwarden account.
    2. Log into shared third-party platforms and click "Log out of all active sessions".
    3. Rotate (change) the shared passwords for services the departing employee had access to.

Safe Password Guidelines​

  1. Generate Unique Passphrases: Use 20+ character random passphrases generated directly inside the password manager.
  2. Master Passphrase Protection: The only password you must memorize is your Master Passphrase for the vault itself. Write it down on physical paper and store it in your physical office safe.