Store your clients' credentials in the Vault

Expand

What is the Vault for?

As an agency, you handle dozens of accesses that aren't yours: a client's hosting, their FTP, a platform login, an API key. Keeping them in chats, emails, or a spreadsheet is messy and risky.

The Vault solves that: it's a central place where each credential stays encrypted and available to whoever needs it on your team, without forwarding it around or exposing it.

How do I store a credential?

In Vault, use New credential. You give it a clear Title (for example, "cPanel Hosting Client X"), choose the Type, and fill in the data accordingly:

• Login, FTP, SSH, Database, Hosting panel, API Key, WiFi, or Note.
• Depending on the type, you fill in Username, Password, Host, URL, Port, or other fields.
• If you need a new key, Generate password creates a strong one instantly.

You can also assign the credential to the client it belongs to, so you find it quickly. If that client's Account is later archived or deleted, the Client column keeps naming it, dimmed, and hovering over it tells you Archived account or Deleted account: that way you can spot the accesses left over from a client who's no longer with you.

How do I use it later, without exposing it?

From the list, without having to type anything:

• Reveal secret shows the password only when you need it.
• Copy username, Copy password, and Copy URL copy each value to the clipboard so you can paste it where you need it.

That way you work with the access without leaving it in plain sight for anyone.

Who can see each credential?

You decide it in the credential's Access block. With Default (role-based), everyone with access to the Vault can see it. With Custom, you restrict it: only whoever created it, the people you choose, and the organization's Owners and Admins —in an Account, also the agency workspace's Owners and Admins— can see it. It's useful for sensitive accesses that not everyone should handle: it restricts the rest of the team, never the Owners or Admins.

The list shows only the credentials you can see, and it isn't live: it refreshes when you enter the Vault, when you go back to the Credentials tab or to the browser window, and after every change you make. If someone on your team adds or changes a credential while you have the Vault open, you'll see it when you come back.

To understand your team's roles, see Roles and permissions: who can see and do what.

How do I send credentials to someone outside my team?

With Share access, instead of pasting the password into an email or a chat: the Vault creates a temporary link protected by a key. The link never carries the password —it's decrypted only when the person opens it—, so it stops working the moment it expires, you revoke it, or you delete the credential.

• Open the credential and, in its Share section, click Share access —or choose it straight from the row menu. To send several together, select them in the list and use Share access in the selection bar: they must all belong to the same client.
• In Expires in, choose 1 h, 24 h, 7 days (the default), or 30 days; in Can be opened, choose Until it expires or Only once.
• Keep the Key the Vault suggests —short and easy to dictate over the phone; Regenerate gives you another one—, add a Message for the recipient if you want, and click Create link.
• Copy the Link —or the Suggested text, which already includes it— and send it by email or WhatsApp. Send the key through another channel instead —a call or a separate message—, never in the same email as the link.

The person opens a page with your agency's name —on your own domain, if you set one up in Branding—, enters the key, and copies each value with its own button. Your internal Notes never travel with the link.

To cut access before it expires, go to the Shared tab and use Revoke in the row menu: whoever has the link can no longer open it, effective immediately. There you'll also see links marked Used (it was single-use and has already been opened) or Blocked (someone tried too many wrong keys; whoever created the link gets a notice in the bell).

How do I ask a client for their credentials safely?

With Request access: your client enters the credentials on a secure page with your agency's name and they land directly in your Vault, encrypted and assigned to that client. Nobody has to send a password by email or chat.

• In the Vault header, click Request access. If you're in your agency's workspace, first choose the Client.
• In What we're asking for, the list starts with an FTP; use Add to include the rest: Login, Hosting panel, Database, SSH, API Key, or Other access for anything else. Each one comes with a suggested title —it will be the credential's name in your Vault— that you can edit.
• Review the Message for the client (it comes pre-written), choose when it expires —24 h, 7 days (the default), or 30 days— and click Create request.
• Copy the Link or the Suggested text and send it to your client. The link is single-use: once the client submits, it stops working.

Your client fills in the ones they have —they don't need to complete them all— and sends them with Send encrypted. You get a notice in the bell and an email, and each credential appears in your Vault assigned to that client, with the date it arrived and, if the person left their name, who sent it. In the Requests tab, View credentials takes you to the list filtered by that client. If anything was missing, create another request.

What your client sees, and what gets recorded: the page shows your agency's name with MB Suite's logo —or with yours, if you set your own App Name in Branding— and explains that everything travels and is stored encrypted. Each time a link is opened or credentials are submitted, the Vault records the date and an anonymous fingerprint of the visitor's connection (never their IP address), plus the name and email they chose to leave. Your organization is responsible for that data: it's kept with the link's record for 180 days after it expires and the credentials themselves stay until you delete them. If you have questions about how MB Suite handles this data, see the Privacy Policy.

How do I change a password?

Open the credential and press the eye: the password is shown and becomes editable right there. Type the new one —or use Generate password to create a strong one— and save. What you see is what gets saved: if you leave it as it was, nothing changes, and every change is recorded in the credential's Activity.