Offboarding checklists have a line item nobody enjoys: "recover shared credentials." The departing engineer knew the login for the DNS registrar, the social media accounts, the legacy firewall, and a dozen SaaS admin panels. Some of those passwords live in a personal password manager the company cannot open. Some live in a spreadsheet. At least one lives only in the departing engineer's head.
The root cause is an ownership mismatch. Consumer password managers treat the individual as the owner, and businesses adopted them anyway because they were better than nothing. TATER Vault starts from the opposite premise: in a company, credentials are organizational assets. People get access to them; they never own them.
Zero-Knowledge, Organizationally Recoverable
Vault entries are encrypted client-side under a master passphrase that never leaves the user's browser — TATER's servers store only ciphertext and cannot read a single password. That is the standard zero-knowledge posture. What makes Vault fit for business is the organizational escrow layer on top: an org-level recovery key, held by administrators, that can restore access to company credentials without ever exposing them in transit or at rest.
The practical effect: when someone leaves, an administrator reassigns their vault entries to a successor in minutes. No lockouts, no password-reset marathons across forty services, and no awkward call to a former employee.
Sharing Without Spreadsheets
Group sharing uses RSA key wrapping: a shared entry is encrypted once, and each authorized group member holds a wrapped copy of the entry key. Add someone to the group and they can decrypt; remove them and they cannot — cryptographically, not just by interface convention. The finance team's banking logins, the marketing team's social accounts, and IT's infrastructure credentials each live in their own group with their own membership.
The Details That Matter Day to Day
Vault carries built-in TOTP so the six-digit codes live next to the credentials they unlock, a browser extension for autofill, breach and duplicate detection across the whole vault, and one-time secret links for sending a credential to a contractor without it living forever in their inbox. Because Vault is part of the TATER platform, access rides on the same identity and audit trail as everything else — signing in to Vault is the same sign-on as Security and Ops, and credential access events land in the same log your auditor already reviews.
A password manager is one of those purchases that looks interchangeable on a feature grid. The ownership model is the difference that shows up eighteen months later, on the day someone resigns.