Legal
Password Vault Terms
Effective Date: October 30, 2026 (Version 2026.3)
These terms apply when you set up or use the Password Vault (Tools > Password vault), and form part of the Terms of Service. The Password Vault is different from "Scan credentials" (the former Secret Vault), which DVSentry can decrypt to run your scans.
1. What it is
Your browser encrypts every entry before it is uploaded, with keys that only your vault passphrase (or your recovery key) opens. Your passphrase and recovery key are never sent to DVSentry. DVSentry stores encrypted data and wrapped keys only, and cannot see, recover or reset what is in a vault. Neither can your organization's Admins or Owners.
2. Lost passphrase means lost data
If you forget your vault passphrase and do not have your recovery key, nobody can open your vault again, including DVSentry. We cannot reset it for you. Keep your recovery key safe: anyone who has it and can sign in as you can open your vault.
3. The limit of a web vault
A vault that runs in a web page is only as trustworthy as the code the page loads. If DVSentry's servers, or a service between you and them, were compromised, the page could be changed to capture your passphrase the next time you unlock. We publish the SHA-256 of the vault's encryption code at /.well-known/dvsentry-client-hashes.json so it can be checked. Keep root, break-glass and production credentials in a password manager with its own installed app.
4. Vaults belong to the organization
A vault lives in the organization you created it in. If you leave the organization or are removed from it, your vaults there are deleted. Export your entries first (the vault page exports them as a CSV file, in your browser). Admins can see the names, sizes and entry counts of vaults, never their contents.
5. What DVSentry can see
Vault names, who owns them, the number and size of entries, and when they changed. DVSentry uses those facts, with the browser, operating system and approximate country of the sign-in session, to email and notify you when an entry changes or a vault is opened in a browser it has not seen before; never what changed. If you turn on breach checks, your browser (not DVSentry) sends a 5-character fragment of each password's SHA-1 hash to Have I Been Pwned; DVSentry receives nothing from those checks. Encrypted data remains in DVSentry's encrypted database backups and write-ahead logs until they roll off (within 35 days).
6. Availability
There is no service level for the availability of anything stored in the Password Vault. Keep your own export of anything you cannot afford to lose. While an organization is suspended you can still unlock and export its vaults, but not change them.
7. Your responsibility
Store only credentials you are allowed to hold. The Acceptable Use Policy applies: never store another person's credentials without their authority, or credentials obtained unlawfully.
8. Lawful requests
DVSentry acts on lawful orders with what it has: the encrypted data and the records in section 5. Because DVSentry never has your keys, it cannot decrypt a vault for anyone, including a court or an authority. Complaints go to our Grievance Officer at privacy@dvsentry.com.
9. Authenticator codes
You can keep another site's authenticator key (TOTP) in a vault entry; your browser encrypts it with the entry and makes the six-digit codes itself. DVSentry never receives the key or a code. The codes are available only while DVSentry is reachable: the web vault keeps no offline copy, so an outage of DVSentry, or of a service between you and it, means you cannot get a code until it is back. Keep each site's own backup codes somewhere else. Once an entry holds an authenticator key, your vault must have a recovery key. Codes in a vault open with the same passphrase as your passwords, so keeping them in a separate vault does not make them a separate factor; hardware security-key protection for a vault is not available yet. DVSentry's own sign-in code cannot be stored in the vault.