Client and work management
Client passwords in the group chat: where they belong
Which login goes in each person's vault, which one in the client's project, and which one you hand over with a link that expires.
Your clients' passwords should not live in a WhatsApp group or an email thread, because there they stay, with no expiry date, on the phone of everyone who was ever in the group. Split them across three places: each person's own logins go in their personal password vault, the logins the team uses to work for a client are stored encrypted in that client's project, and when someone needs one just once you send it with a link that expires. Then you change the passwords that already went through the chat.
Picture an agency that runs websites for its clients. One Monday a client's online store goes down, the developer who knows the hosting panel is on vacation, and someone starts scrolling up and down the "Client logins" group, which holds two years of messages. Three different passwords show up for the same panel. The one that works was sent by a designer who left the agency six months ago and who, by the way, still has that chat on her phone.
Why a chat is a bad place to keep logins
A message with a password is copied to every phone in the group, to their backups and to every forward. Nobody knows which version is current, because the new one does not erase the old one. When someone leaves the company, they take the whole history with them. And if the client asks tomorrow who signed in to their panel, you have no way to answer: the chat records who wrote a login, not who used it.
The group exists because the team needed a shared place and nobody set up another one.
Three kinds of login, three different places
Before you move anything, sort what is in the chat by who each login belongs to:
- Personal logins: your user on a provider's panel, your account in a tool, your SSH keys. One person uses them.
- Client logins the team shares to do the work: the hosting, the domain, the site's content manager, the social accounts you run for them.
- One-off handovers: the login you pass once to an outside contractor or to the client's new IT person.
Each kind has its place in AgentticCRM. As long as they stay mixed in the chat, the group keeps growing.
A personal password vault for each person on the team
AgentticVault is the personal password vault of each person on the team. Everything is encrypted in the browser before it is saved, and it opens with its own passphrase of at least 12 characters, separate from the account password. It requires a second factor and locks itself after 10 minutes of inactivity. Neither your organization's administrators nor the AgentticCRM team can read it.
It holds nine record types, including logins, secure notes, SSH keys, database logins and certificates. If you already use 1Password, Bitwarden, LastPass or KeePass, you import the file you exported and then delete it from your computer, because it usually holds all your passwords unencrypted. In Google Chrome, the extension fills in the username and password on the sign-in page, but it never submits the form for you.
The vault is personal and does not share items between people. What the whole team uses goes in the client's project.
Client logins, stored in their project
The credentials your team shares to work for a client are stored encrypted in the project itself, next to its links and files. Your team sees them; your client, in their portal, does not. Every time someone reveals one, it is recorded in the activity log, so the question "who revealed the hosting credential?" has an answer with a name and a time.
In the agency example, the hosting panel login would sit in that store's project. Whoever covers the vacation finds it there, in a single version, without searching the chat.
When someone needs a password just once
To hand a login to someone else, use Confidential sends. You type the recipient's email and the message, your browser encrypts it and that person gets an invitation. They do not need an account: they ask for a six-digit code that arrives by email and expires in 10 minutes. The message is deleted when they confirm they are done and, if they never open it, it expires after 24 hours; no option keeps it available for more than 48. In My sends you can see whether they used it, and if you picked the wrong recipient you click Revoke access.
If you also need to send files, such as a backup or a certificate, that takes another route, which we cover in how to send large files to a client.
What to do with the passwords already in the chat
Moving the logins is not enough: the old copies are still on the phones. A sensible cleanup goes client by client:
- List the logins that appear in the group for that client and decide which of the three places each one goes to.
- Store the team's logins in the client's project and ask each person to move their own to their vault.
- Change every password that went through the chat, in the client's system and in agreement with the client. AgentticCRM does not change passwords in other systems.
- Remove from the group anyone who no longer works with you, and turn on a second factor in the services that allow it.
Frequently asked questions
Can I share my vault with a coworker?
No. AgentticVault is personal and does not share items between people. What the whole team uses for a client goes in the project, and what someone needs once is sent with a confidential send.
Can my organization's administrator see my passwords?
No. Titles, usernames, websites and notes are stored encrypted. The activity log only shows the action, for example that you copied a field, and when it happened.
Can a connected ChatGPT or Claude read my passwords?
No. Neither the Assistant nor a connected ChatGPT or Claude has access to AgentticVault, and they cannot open or create a confidential send either.
What happens if I forget my passphrase?
You recover it with the recovery code that is shown only once when you create the vault, and you choose a new passphrase. Because nobody else can decrypt your vault, neither administrators nor support can recover it for you.