Account recovery Coming soon
A forgotten master password shouldn’t stop the work
If someone loses both master password and recovery code, without company recovery their data is lost. With recovery on, a company custodian gives them access again. It is a real access, and that’s why it leaves a trace.
Recovery is an access, and we say so upfront
A custodian can open the account of a person in the company. That’s why every action stays on record: the person concerned is notified if they can still sign in, the other administrators always. Switching it on is the company’s choice: when it’s off, anyone who loses master password and code loses their data, and the personal vault of a leaver isn’t transferred. The recovery key is created on the first custodian’s device: the server neither receives nor stores the keys.
How it works
-
Recovery is started
Whoever has the “Account recovery” privilege starts it and becomes the first custodian. They then admit a second one, after verifying their key in person.
-
The person requests a restore
From the unlock screen they receive an eight-word code, to tell a custodian in person or by voice, never by message or email.
-
The custodian restores access
They type the eight words after speaking to the person, who chooses a new master password. All the keys of the account change, and the entries the custodian could read are flagged to change.
Recovery is an access: that’s why it leaves a trace.
What you can do
-
The personal code comes first
Anyone who still has their recovery code gets back in alone, without a custodian, and receives a new code. Company recovery is for when that is missing too.
-
A wait to stop impostors
If the account was used recently, the request waits a few hours. Meanwhile the real person can cancel it from one of their devices.
-
Two keys, if you want them
With “Switch to two keys”, every restore needs a custodian from set A and one from set B, and nobody sits in both. To withstand losing a custodian you need two per set.
-
Immediate alerts
Administrators and custodians are notified as soon as a request starts. The person concerned is notified if they can still sign in, and can answer “It wasn’t me”.
-
A history that stays
Every restore requested enters the account’s recovery history, completed or not. No Kamzan Pass function deletes it, for any privilege.
-
A fingerprint to check on paper
The welcome sheet carries the recovery fingerprint: everyone compares it with their own page. It’s the way to notice if the server presents a different key, but it must be handed over in person.
Frequently asked questions
Can a custodian read my passwords?
A custodian can open the account of a person in the company: recovery is an access, and it’s right to know that before switching it on. That’s why it stays on record, and at the end of a restore all the account’s keys change and the entries they could read are flagged to change.
What do the two keys add?
Every restore needs two custodians, one per set. It isn’t an absolute guarantee: two custodians in agreement can swap keys once, outside the system, and act alone from then on. No system can prevent that.
What if all custodians lose access?
Anyone who remembers their master password keeps working, but nobody can be recovered until recovery is re-founded. The re-founding waits 7 days, everyone is notified, and each person accepts it by typing a fingerprint received on paper or from someone other than the proposer.
Can we switch it off?
Yes. For 7 days nothing changes and custodians can withdraw the shutdown; then the recovery envelopes are deleted. The transfer on departure switches off too. Switching off doesn’t erase the past: envelopes remain in backups for their retention period, and a custodian may have kept the key.
The other Kamzan Pass features
Want to see it before it arrives?
We show you Kamzan Pass on a test vault: how a password is shared, what happens when someone leaves the company and what the server doesn’t see. Half an hour, no strings attached.
Alex