Frequently asked questions

Companies of 10 to 200 people that work with shared accounts: e-commerce sellers, agencies, accounting firms and any team whose accounts are used by several people.

We have no plan for individual or family use.

Not in the cloud service. You create your organisation, set your master password, print your recovery kit and invite your team. No directory, single sign-on or server is needed.

The interface is in Turkish and English. The Turkish texts are written in Turkish, not translated.

It does not do privileged access management for servers and network devices (session recording, RDP or SSH brokering). It does not change passwords on the target system by itself; it says what must change and tracks it. It does not provide virtual numbers; the code inbox works with your own line.

No. Vault contents are encrypted and decrypted only on your devices; the server stores ciphertext. The full list of metadata the server sees (who accessed what, when and why) is on the security page.

Argon2id for key derivation, XChaCha20-Poly1305 for encryption, X25519 for passing keys and Ed25519 for signatures. All cryptography is done with libsodium.

An owner of your organisation can recover your account with the recovery kit. You get a temporary password and set your own at the first sign-in. Your sessions on every device end and you are e-mailed.

Owners can create a new kit; doing so renews the organisation keys. The kit should be kept in a physical safe; whoever takes it can open the shared vaults.

In Türkiye for the cloud service. Only on your server when you install it yourself.

An independent review of the cryptographic design and a penetration test will be done before release; a summary of the results will be published on the security page. We do not present them as done.

An item is an account (e.g. the Trendyol seller panel). A vault is the unit of items and permissions: someone you grant access to a vault reaches its items at that level.

Use: fills with the extension without seeing the password. Reveal: sees and copies. Edit: adds and changes items. Manage: shares and exports the vault and manages its permissions.

Not by default. Owners and admins can see vault names and item titles; to see passwords they need a permission on that vault. When they grant themselves one, that is recorded too.

Yes. Give the grant an end date; when it runs out, access closes on its own. Employees can also ask for timed access with a reason; the vault manager approves.

All of the person's sessions and keys are revoked at once. Passhield works out whether they saw each password and lays out what must change, ownership to hand over and keys to renew in a task list.

No. When you change the password in Passhield, its task closes on its own. If you skip a task on purpose, your reason goes into the report.

It is archived. Its contents cannot be opened by the organisation; only the number of items is visible in the process.

Directory integration is coming soon: the person's account will be suspendable with the offboarding. Until then it appears as a separate task on the list.

TOTP is the code apps such as Google Authenticator generate; in Passhield it is kept in the item and generated in the browser. An SMS code arrives on the company line by text message; it reaches Passhield through the forwarder app.

Soon. The server side, channels, rules, the code inbox and the phone pairing wizard are ready; the Android app for the phone is being released.

No. Only messages that match your sender rules are forwarded; the rest never leave the phone. A broad rule that would forward everything asks for an acknowledgement.

Sharing codes of bank and government systems may breach their terms; we recommend a personal user for these accounts. Channels in these categories ask for an explicit acknowledgement and keep codes for at most one hour.

The extension is for Chrome and Edge; the store listings are in preparation. Firefox and Safari come after the first release. The web app runs in any up-to-date browser.

No. An item is suggested only on its saved address's site, and the origin is checked again at the moment of filling.

On the import screen, choose the file, map the columns and choose the target vault. The file is read in your browser and never sent to the server. A detailed guide is in Resources.

Yes: Bitwarden (JSON or CSV), 1Password (CSV), KeePassXC (CSV) and the password exports of Chrome and Edge are supported.

Every feature is in every plan. Plans differ by members (10, 50, 200), vaults and code lines; directory integration will be in the Team and Business plans.

Yes. A vault's manager can export it to a password-protected archive or, after confirming, to CSV; the audit log exports as NDJSON. Your data is yours.

When an organisation is closed, its data is permanently deleted after 30 days and drops out of backups within 35 days.