Read-only access · Full audit trail · Instant revocation

Contractor Password Access
Done Properly

Stop sharing credentials over Slack or giving contractors your master password. SealedKeys lets you grant contractors controlled, audited, read-only access to specific credentials — and revoke it instantly when they leave.

How contractor access works

From invite to offboarding — a clear, auditable process.

1

Invite the contractor

Send an invite to the contractor's email. They create their own SealedKeys account — no master password shared.

2

Grant read-only access

Add them to the relevant organisation vault with a Read-only role. They can view and copy but cannot edit, delete or export.

3

Monitor access in real time

The audit log shows every credential they view or copy — with timestamp and IP. No surprises.

4

Revoke access on offboarding

Remove the contractor from the organisation. Instant revocation — no password resets, no chasing.

Why this matters for security

No shared master passwordsEach contractor has their own account. You never share your credentials with them.
Zero-knowledge architectureSecrets are encrypted in the browser. The contractor's device decrypts only what they're authorised to see.
Complete access historyWhen a contractor claims they need a credential, you can verify whether they've already accessed it — and when.
Clean offboardingRemove them from the org. Done. The audit log tells you exactly what to rotate.

Frequently asked questions

Can a contractor access my vault without knowing my master password?+

Yes. Each contractor has their own SealedKeys account and their own vault key. You share specific vault items with them through the organisation — they decrypt those items using their own credentials, not yours.

What can a read-only contractor do?+

A read-only member can view and copy vault items they have access to. They cannot add, edit, delete or export items. All access is logged in the audit trail.

How do I know which credentials a contractor accessed before they left?+

The audit log records every item view and copy event with the user's name, the item accessed, the timestamp and the IP address. You can filter by user to see a complete list of what a specific contractor accessed.

Do I need to change all my passwords when a contractor's contract ends?+

You don't need to change everything — just the credentials they actually accessed. The audit log tells you exactly which items they viewed, so you can focus rotation on those specific credentials.

Can I create a separate vault for contractors only?+

Yes. You can create a separate organisation in SealedKeys for contractor access — keeping it completely separate from your main team vault. Contractors only see what's in their org.

Related

Give contractors access. Not your trust.

25 items free. Up to 3 members. No credit card required.