Emergency access

Emergency access lets a Super Admin temporarily look into one vault when an incident cannot be solved through ordinary access, for example when a vault’s only Manager has left or is unreachable. It is deliberately narrow and loud.

What a session allows

• One vault, for at most 30 minutes.
• Read-only: browse the vault, its folders and entries, and reveal or download individual values.
• Nothing else: no editing, deleting, moving, exporting, no folder changes, and no grant changes. A session can never turn into standing access.

Every reveal inside a session is recorded with the same audit events as an ordinary reveal.

Starting a session

1. Open System → Emergency access.
2. Choose the vault, enter a reason and optionally an incident or ticket reference.
3. Confirm with your password and a fresh second-factor code. A remembered device does not count.

A banner stays visible for the whole session. Starting a new session ends any session you already had open.

Ending a session

Choose End access at any time. The session also ends automatically after 30 minutes. Expiry is checked on every request; a later reveal simply fails.

A session also ends immediately when its holder loses the Super Admin role, is deactivated or offboarded, or has their factors reset or recovered. Restoring the role does not bring the session back.

Who is notified

• If there are other active Super Admins, all of them are notified.
• In a sole-admin installation, the security notification recipients from Settings are notified instead.

Notifications are stored durably and retried until delivered. They name the audit event, never vault contents.

Audit trail

• vault.emergency_started: vault, reason, incident reference and authentication method.
• vault.emergency_ended: closed, expired or revoked.
• Individual reveals and downloads: the ordinary entry.secret_delivered and attachment.download_started events.

Treat every emergency session as something to review afterwards. If the session revealed credentials, consider rotating them; see Offboarding.

Limits

Emergency access is an accountability mechanism, not a protection against the server operator. Someone who controls the host can read everything regardless. See Security model.