Secure Vault
Store, organise, and protect sensitive credentials, documents, and records with AES-256 encryption. Manage folders, control per-user access, and get instant alerts for weak passwords — all within TeamTrackin.
Vault Overview
The Secure Vault is TeamTrackin's AES-256 encrypted storage for sensitive company data — credentials, documents, and secure notes. The top bar shows a global KPI summary (Folders, Records, Documents, Weak passwords). Toggle between Folder view and Grid view using the buttons in the top-right. Click + Add new to create a record or folder.
| KPI | Description |
|---|---|
| Folders | Total top-level and sub-folders in the vault |
| Records | All encrypted records — credentials, documents, and custom types |
| Documents | Records categorised as Document type (files, PDFs, presentations) |
| Weak passwords | Credentials flagged as weak. Click to see which records are affected and update them. |
Folder View
The default Folder view shows all vault folders as expandable rows. Clicking the chevron opens a folder to reveal its records. Each row shows a record/sub-folder count, an Open button to navigate inside, and a three-dot menu for folder actions.
| Element | Description |
|---|---|
| Chevron (▶/▼) | Click to expand or collapse a folder — reveals records stored inside |
| Colour icon | Shows the folder’s assigned colour (blue, red, green, amber, purple) |
| Record/sub-folder count | “X records” or “X sub-folders” — shows what’s inside without expanding |
| Open button | Navigates fully inside the folder to see all records and sub-folders |
| Three-dot menu (⋮) | Folder actions: rename, move, manage access, delete |
| Record type badge | Blue = Document, Red = Credentials |
Grid View
Switching to Grid view displays all top-level folders as visual cards, each with a colour-coded banner, a record count badge, folder name, and summary. An Add new card at the end lets you create a folder or record without using the top button.
Grid view shows only top-level folders. Sub-folders and individual records are not visible until you click into a folder. Use Folder view to see expanded record listings without navigating.
Folder Preview Panel
Clicking a folder name (not the Open button) in Folder view opens a slide-out preview panel on the right. This shows the folder's record count, sub-folder count, encryption type, access level, and a list of all records inside — without navigating away from the main listing.
| Panel section | Description |
|---|---|
| Records count | Number of individual records in this folder (red) |
| Sub-folders count | Number of nested sub-folders inside (blue) |
| AES-256 | Confirms all content is encrypted at rest using AES-256 |
| Restricted access | Only the people this folder was shared with (and the account owner) can view its contents — see Manage access |
| Records list | Names and types of each record inside — click any to open its detail panel |
Record Detail Panel
Clicking any individual record opens its Record Detail Panel on the right — showing all stored fields: record type, username, password (masked), website address, notes, and attachments. A Weak badge appears next to passwords that fail strength requirements.
| Field | Description |
|---|---|
| Record type | Credentials, Document, or a custom type — determines which fields are shown |
| Username | Stored login email or username. Shows “Not given” if blank. |
| Password | Masked by default. Eye icon to reveal. Weak badge if password fails strength check. |
| Website address | Associated URL — clickable link that opens in a new tab |
| Notes | Free-text context added when creating the record |
| Attachments | Files attached to the record — click the download arrow to retrieve securely |
| Copy button | Copies any field value to clipboard without revealing the full value on screen |
Creating a Record
Click + Add new and select Record to open the record creation form. Choose a vault location, record type, and title. Fill in credential fields (username, password, website), add notes, attach files up to 10MB, and optionally add custom fields for non-standard data. Records are encrypted automatically on creation.
| Field | Required | Notes |
|---|---|---|
| Location | No | Which folder to store the record in — defaults to “My Vault” root |
| Record type | No | Credentials (login/password), Document (file), or a custom type |
| Title | Yes | The name shown in the folder listing and preview panel |
| Username / Password | No | Stored AES-256 encrypted. Password is masked by default and automatically checked for strength. |
| Attachments | No | Drag and drop files up to 10MB — documents, images, videos |
| + Add custom field | No | Add extra labelled fields for this record (e.g. License key, API token, PIN) |
Creating a Folder
Click + Add new and select Folder to create a new vault folder. Choose a location (root or inside an existing folder to create a sub-folder), enter a name, and select one of five colour themes to visually distinguish it from other folders.
Managing Access
Select Manage access from the three-dot menu to open the access control modal. Add team members and assign permissions. All vault access is encrypted — users can only see items they've been explicitly granted permission for. Admins always retain full access regardless of settings.
Access is encrypted. Users can only see this item if granted permission. Admins always retain full access.
| Permission | View | Edit | Delete | Manage access |
|---|---|---|---|---|
| Full access | ✓ | ✓ | ✓ | ✓ |
| Edit | ✓ | ✓ | ✗ | ✗ |
| View only | ✓ | ✗ | ✗ | ✗ |
The record Owner always has Full access and cannot be removed. All Admin accounts retain visibility into all vault items regardless of individual record permissions set here.
Password Health
Choose Password health at the top of the vault to check the login records you can see. Unlock the vault first — the check runs in your browser on your unlocked records, so passwords are never sent anywhere and the vault stays end-to-end encrypted.
| Group | What it finds |
|---|---|
| Weak | Short or simple passwords that are easy to guess. |
| Reused | The same password is used on more than one record. |
| Old | Passwords that haven't been changed for a long time. |
| Missing | Login records with no password saved. |
You also get an overall score — Looking good, Room to improve or Needs attention — and the number of records checked. When a group is empty you'll see “Nothing here — nice work.”
One-time 2FA Codes
Many sites ask for a 6-digit code from an authenticator app. Keep that with the login: when you create or edit a record, paste the site's setup key or otpauth:// link, or upload its QR code. The record then shows a live One-time code that anyone with access to the record can copy when they sign in.
The secret is encrypted with the rest of the record, so only people you've given access can see the codes.
Expiry Dates & Reminders
Some logins and documents stop working on a known date — a contract, a licence or an API key that has to be rotated. When you create or edit a record, set Expires on. It's optional: leave it blank and the record never expires.
Records close to their date show an Expires in … days or Expired badge, and a strip at the top of the vault and on your dashboard counts how many are due.
| Reminder | When |
|---|---|
| Due soon | 14 days before the date (the company can change this). |
| Final reminder | 3 days before the date. |
| Expired | On the day it expires. |
Reminders arrive by email and in the app. Choose Reminders at the top of the vault to pick who else gets them, how many days ahead the first one goes out, and whether the record's creator is told too. Changing those needs the Expiry reminder settings vault permission.
Reminders only name the record and its date — never its username, password or files. Setting a new date starts the reminders again.
End-to-end Encryption
Vault records are encrypted in your browser before they are saved, so only the people and clients a record is shared with can open it. Your master password is protected with Argon2id, which makes it slow and costly to guess. Vaults set up earlier switch to it automatically the next time you unlock — nothing to do.
Records saved before end-to-end encryption were encrypted with a server key. While there are any, owners and admins see Upgrade encryption at the top of the vault with how many are left. The account owner upgrades them:
A record only switches once its new copy is saved and checked, so stopping halfway never loses anything. The old unencrypted copies, files included, are then permanently removed. When it finishes, every record and file in the vault is end-to-end encrypted.
Teammates or clients who haven't set up their vault key yet keep their access. Once they sign in, finish teammates under Vault resets, and for clients open the record's Manage access → Portal clients → Share again.
Keep Sensitive Data Locked and Secure
Store credentials, documents, and files in TeamTrackin's AES-256 encrypted Secure Vault — with per-user access control, weak password detection, and organised folder management.