Rules and event log Coming soon
Rules for the whole company, and a log that says what it really knows
Whoever manages security wants two things: to raise the bar for everyone and to be able to reconstruct what happened. Kamzan Pass gives you both, and says exactly how far they go.
A rule written in a document stops nobody
At Studio Morelli the policy said “long passwords, vaults locked when you get up”. Now those values live on the “Rules” page: set once, valid on every device. Rules on master password, locking and export are applied by each person’s client, because the server does not see the master password: a compromised server could loosen them, but never below the fixed minimums.
How it works
-
You set the rules
On the “Rules” page, five groups: Master password, Locking and session, Sharing, Retention and waiting times, Export. Under each field you read the allowed range.
-
Devices apply them
Each device reads the rules and uses only those stricter than the minimums. Durations, such as log retention, are applied by the server.
-
The log tells the story
Each row carries a mark: “attested” if it went through the server, “declared” if a device reported it. Filter by type, source and person.
The log says who could see and who declared they opened. It doesn’t pretend to know more.
What you can do
-
A master password that holds up
The minimum is 12 characters, with the top score on the strength estimator: you can only raise it. It applies at creation and change, without blocking anyone who already has a shorter one.
-
The vault locks itself
Locks after 15 minutes of inactivity, 30 at most if the company chooses, and in any case 8 hours after unlocking. It depends on the clock and browser: a hibernated computer weakens it.
-
Reducing is never immediate
Shortening a wait or retention only applies after the old period: the date appears under the field. Increasing applies at once. So nobody can shorten times to cover an action.
-
Attested or declared, always labelled
An item created or a member added is attested by the server. “Item opened” or “Password copied” is declared by the device: useful, not proof, and a modified client can stay silent.
-
Identifiers, not secrets
The log holds identifiers only. Item and vault names appear only where you are a member: anyone reading the log from outside the vault sees “an item in vault 7f3a…”.
-
Some events stay
Others follow the chosen retention, from 180 days to 5 years. Those on recovery, privileges, rules and deactivations are never deleted: they stay as long as the company exists.
Frequently asked questions
Does the log tell me who looked at a password?
No, and no log can. It says who was a member of the vault, attested by the server, and who declared opening the item, as reported by their device. A password can be known with no declaration at all, for example by someone who exported the vault.
Do the rules really apply to everyone?
They are applied by the program on each person’s device, not by the server, which does not see master passwords. “Everyone complies” is therefore a declaration by devices. A compromised server could loosen them, down to the fixed minimums and no further.
Can I forbid plain-text export?
Yes: with the rule off, clients no longer offer it. It doesn’t, however, stop someone who has the items in front of them from copying them: it’s a device rule, like the others.
Is account recovery a rule?
No. Turning it on or off, or moving to two keys, is an act signed by the custodians, from the “Recovery” page. The “Rules” page only decides how long to wait before a restore.
The other Kamzan Pass features
Want to see it before it arrives?
We show you Kamzan Pass on a test vault: how a password is shared, what happens when someone leaves the company and what the server doesn’t see. Half an hour, no strings attached.
Alex