Vault in Client Portal

Portal contacts can access vault secrets shared with them through the concorbit client portal. This guide explains what portal users see, how access is determined, and how to grant vault access to your clients.

Overview

The portal Vault page provides read-only access to secrets for authenticated portal contacts. There is no ability to create, edit, or delete secrets from the portal, it is strictly a viewing interface.

Portal contacts can access secrets through two mechanisms:

1. Individually shared secrets: Secrets shared with the contact using Portal contact mode. (Anonymous external-link shares are not surfaced in the portal, they are reachable only via their public URL.)

2. Company vault folders: Secrets stored in vault folders that are scoped to the contact's company.

What Portal Users See

When a portal contact opens the Vault section of the portal, they see a list of accessible secrets. Each secret displays:

• Secret name: The name assigned to the secret.

• Secret type: The type label (Password, API Key, etc.).

• URL: The associated URL, if set.

• TOTP indicator: Whether the secret has a TOTP seed stored.

• Expiry date: For individually shared secrets, when the share expires.

Revealing Secrets in the Portal

Portal contacts can click on a secret to reveal its decrypted value. The reveal process works the same as for team members:

1. The contact clicks the reveal button.

2. The server decrypts the secret and returns the value via JSON.

3. The decrypted username, value, notes, and TOTP seed are displayed.

4. Each field has a copy button for clipboard access.

Every portal reveal is logged in the vault audit trail with the contact's ID and an actor type of "Contact", so you can distinguish portal access from team member access.

View Tracking for Shared Secrets

When a portal contact reveals an individually shared secret:

• The view count on the share record increments.

• The first-view timestamp is recorded.

• If the share has a max views limit and the count reaches it, subsequent reveals are blocked.

Company vault folder secrets do not have view limits, they remain accessible as long as the contact has portal access and the folder exists.

Granting Vault Access to Contacts

Method 1: Share Individual Secrets

To give a specific contact access to a specific secret:

1. Navigate to the secret in your Vault.

2. Click Share.

3. Choose Portal contact mode and select the CRM contact you want to share with.

4. Set the expiry window and optional view limit.

5. Click Share.

The shared secret appears on the contact's portal Vault page automatically; they reveal it after logging into the portal. A portal-contact share does not produce a public URL.

An anonymous External link share (one created without a contact) does not appear for portal contacts at all, it is reachable only via its public share URL. Use a portal-contact share when you want the secret to show up inside a specific contact's portal account.

Method 2: Company Vault Folders

To give all portal contacts at a company ongoing access to a set of credentials:

1. Navigate to the company record in the CRM.

2. Open the company's Vault section.

3. Create a folder and add secrets to it.

All portal contacts associated with that company can access secrets in the company's vault folders. This is the preferred approach for credentials that a client needs ongoing access to, such as:

• Hosting control panel logins

• CMS admin credentials

• Third-party service accounts managed on the client's behalf

Method 3: Public Share Links

For one-time credential delivery where the recipient does not need ongoing portal access:

1. Share the secret without associating a contact.

2. Send the share URL directly to the recipient.

3. The recipient can view the secret without logging into the portal.

This method works for anyone, whether or not they have a portal account. See Secret Sharing for details.

Access Control for Portal Vault

Individual Shares

A portal contact can access an individually shared secret if:

• The share is associated with their contact ID. Anonymous External link shares (no contact ID) are never surfaced in the portal, they are reachable only via their public share URL.

• The share has not expired (current time is before the expiry timestamp).

• The share has not exceeded its max view limit (if one was set).

Company Vault Folders

A portal contact can access secrets in a company vault folder if:

• Their contact record is linked to the company (via company_id).

• The vault folder's company_id matches their company.

• The folder belongs to the same tenant.

Company vault folder access does not use the staff/management/director tier system. Any portal contact linked to the company can access all company vault folders.

What Portal Users Cannot Do

Portal contacts have strictly read-only access:

• They cannot create secrets or folders.

• They cannot edit or delete existing secrets.

• They cannot share secrets with others.

• They cannot view the vault audit log.

• They cannot export the vault.

• They cannot access tenant-scoped folders or personal folders (only company folders and individually shared secrets).

Portal Vault Prerequisites

For the portal Vault to be available to a contact:

1. Portal must be enabled: The tenant must have the portal feature active (concorbit plan or above).

2. Contact portal access: The contact must have portal_enabled set to true on their record.

3. Active session: The contact must be authenticated via the portal (email/password or magic link).

If a contact has portal access but no secrets have been shared with them and their company has no vault folders, the portal Vault page will display an empty state.

Security Notes

• Portal vault access is scoped by tenant. A contact cannot access secrets from a different tenant.

• Reveals from the portal are always logged with the contact's identity, providing a clear audit trail.

• Shared secrets with view limits are enforced, once the limit is reached, the secret cannot be revealed again through that share.

• Company vault folder access is binary: if the contact belongs to the company, they can access all that company's vault folders. There is no per-folder or per-secret permission for portal contacts.

• For granular, time-limited access, prefer individual secret shares over company vault folders.