# Password manager: Team password manager > The password vault has private and shared entries, all encrypted, and only people whose role grants access see the shared ones. You reveal a password with a code sent by email and share it with outsiders through a link that works once. Anyone who loses the role loses access right away, and neither the AI nor an API key can reach the vault. - Page: https://www.ciro-noise.de/funktionen/passwoerter - Deutsche Fassung: https://www.ciro-noise.de/funktionen/passwoerter.md When the Instagram password sits in the chat, everyone who was ever in the channel can read it. In the CIRO NOISE password manager you store it encrypted in the team vault, which only roles with access can see, and anyone who loses the role loses access the same moment. To reveal it, each person needs a code sent by email. ## A vault that belongs to the company The vault has two kinds of entries. Private entries belong only to the person who created them, and not even the organization's owner can see them. Shared entries and folders, like the Instagram account or the hosting login, are visible to anyone whose role grants access to team passwords. Folders sort the entries, and the role decides who gets in. All entries are stored encrypted on the server. Day to day it works like this: to reveal a password, the person gets a code sent to their own inbox as a second factor. After that the vault stays unlocked for 60 minutes. Anyone who enters the code wrong too often has to wait, so nobody can guess their way in. If someone outside the company needs access once, you send a link that works exactly once: the agency opens it, sees the password, and the link is used up. Nobody has to send a password in a message. The vault uses the same roles as the wiki and tasks. In the role editor you decide which role may only read team passwords, which may also add them and which sees none at all. Anyone who leaves the organization or loses the role is out the same moment, and nobody has to go through a list and change passwords. The AI doesn't read the vault, and outside AI tools don't either. The vault is built for the logins a team manages together: the Instagram account, the hosting provider, the account with your wholesaler. Each person can keep a personal password manager that autofills in the browser alongside it. Shared logins belong in the vault, because there the role decides who gets access. ## Only people with access see team logins Private entries stay private, and shared ones are visible only to people whose role grants access. - **Share logins by role**: Shared entries and folders are visible to anyone whose role grants access to team passwords. If someone loses the role, their access ends the same moment. - **Give the agency a link that works once**: You give a password to someone outside the company without sending it. The link reveals it exactly once and stops working afterward, and the other side needs no account. - **The vault locks itself**: Revealing a password takes a code sent by email, then the vault stays open for 60 minutes and locks itself. Anyone trying to guess codes has to wait after too many wrong attempts. - **Keep private things private**: Private entries are visible only to their owner, and not even the organization's owner can see them. All entries are stored encrypted on the server, and a password becomes readable only after the second factor. ## Three moments when a password would otherwise end up in the chat The shared account, the agency and the day someone leaves. ### The team needs the Instagram account Mara creates the entry in the shared “Marketing” folder, with address, username and password. Ben, a student intern with the Marketing role, wants to post in the afternoon: he reveals the password, gets the code by email and has the vault open for 60 minutes. The warehouse temp doesn't see the vault at all, because her role has no access to team passwords. The password never shows up in the chat. - Team folder, access through the role - Second factor by email - Open for 60 minutes, then locked ### The agency needs access to the shop once Instead of emailing the password, Kira generates a link that works once and sends only that. The agency opens it, sees the password and enters it. After that the link is used up, and a second click shows nothing. The agency needs no CIRO NOISE account for this. The password never sits in plain text in an inbox or a chat. - Link works exactly once - No account on the other side - No password in mail or chat ### Tim leaves the company Kira removes Tim from the organization with one click in the settings. All shared entries disappear for him the same moment, and nobody has to go through a list. His private entries were never seen by anyone but him, not even Kira. - Role gone, access gone - One click in the settings - Private stays private ## The vault in detail The key vault features in one sentence each. - **Private passwords**: Private entries belong only to the person. Even the organization's owner can't see them. - **Share passwords with your team**: Shared entries are visible to anyone whose role grants access to team passwords, using the same roles as the rest of the organization. - **Stored encrypted**: All entries are stored encrypted on the server, and a password becomes readable only after the second factor. - **Second factor to reveal**: A code goes by email to the person's inbox, and the vault stays unlocked for 60 minutes afterward. - **One-time link for outsiders**: A link reveals the password exactly once, with no account on the other side. - **Revoke access instantly**: Anyone who loses the role or leaves the organization stops seeing shared entries the same moment. The AI and outside AI tools don't read the vault. - **Protection against guessing**: Anyone who enters a code wrong too often has to wait before trying again. ## Tell Claude. CIRO NOISE records it. ### Ask for a password > Can you give me the password for the bank portal? I can't reach the vault, because CIRO NOISE never hands passwords to Claude. You'll find the password in CIRO NOISE under Passwords › Team › “Bank portal”. To show it, you'll get a code by email. ### Renew access > Our bank portal access expires at the end of the month. Who takes care of it, and how does renewal work? Make it a task. Petra Lang in Finance takes care of it. She has FIN-30 “Renew bank access”, due Fri Oct 16, so before her vacation from Oct 20 to 24. Per the wiki, renewal takes four steps: request in the portal, two signatures from management, a new card, and finally replacing the vault entry. Sabine Kurz is mentioned on FIN-30 as backup in case it isn't done by Oct 16. ## Frequently asked questions ### Do I need another password manager for company logins? No. Social media accounts, supplier portals, Wi-Fi and software licenses live encrypted in the CIRO NOISE vault and are shared by role. New people get access to the team vault with their role, and anyone who leaves loses them the same moment. ### How secure are our passwords? They sit encrypted in the vault, and a password only becomes readable when you reveal it with a second factor: a code sent to your inbox. After that the vault stays open for 60 minutes. Anyone trying to guess codes has to wait after too many wrong attempts. ### Does the vault stay closed to the AI and other software too? Yes, completely. Neither the built-in AI nor Claude nor software with an API key can reach the vault. Only a person reveals passwords, after the second factor. ### How do I separate private and shared logins? Every entry is either private or belongs to the team. Private entries are visible only to their owner, shared ones to everyone you give access. Company accounts live in one place, and personal stays personal. ### How do I give a password to someone outside? With a link that works exactly once. The person opens it, sees the password, and the link is used up. They don't need a CIRO NOISE account for it, and no password ends up in the chat. ### What happens when someone leaves the team? You remove the person from the organization, and all shared entries disappear for them the same moment. Nobody has to go through a list, and their private entries were never seen by anyone else. ### What does the vault cost? Nothing extra. The first two seats are free, all features included, no credit card; each additional seat is €25 a month plus VAT, cancel anytime. The vault is included in every seat. ## CIRO NOISE at a glance - CIRO NOISE is a workspace for small businesses and teams of up to about 50 people: wiki, tasks, customer requests, finance with quotes and invoices, customers (CRM), meetings, knowledge with AI, social media, password vault, and time tracking behind one login. - Price: the first 2 seats are free, with every feature. Each additional seat costs €25 per month plus VAT. No credit card to start. - Privacy: servers and AI run in EU data centers, content never trains AI models, and permissions apply per person and feature. - AI connection: Claude and other AI assistants connect through MCP, the open standard for AI tools, with exactly the permissions of the person. - Provider: CIRO GmbH, Eching, Germany. Contact: hello@ciro.gmbh, phone +49 89 24 88 31 22.