Departures Coming soon
Leavers lose access, and you know which passwords to change
When someone leaves the company the question is always the same: what did they know? The departure report lists the entries they could see, and those who stay find them under “To change” until they really are different.
Removing someone doesn’t make them forget
Anyone who has seen a password knows it. Removing someone from a vault changes the keys and prepares the list, but the password has to be really changed, on the site. For the personal vault there is the transfer: it passes to a colleague only through company recovery, and must happen before the keys are deleted, 30 days after deactivation.
How it works
-
You remove access
From the portal’s user management you suspend the person or remove their access. From that moment they can’t open their vaults and leave the shared ones.
-
You open the departure report
It lists the shared vaults they belonged to, with the period, and the entries with their mark. That’s where you decide where to start.
-
You transfer and change
You choose who receives the vaults and a custodian carries it out. The recipient accepts them, changes their key and changes the marked credentials.
Anyone who has seen a password knows it: change it.
What you can do
-
Two marks, two meanings
“Could see it” is attested by the server. “Declared opened” comes from their devices and is no proof: an entry never declared must be changed anyway.
-
“To change” for those who stay
Those who stay in the shared vaults find those credentials on the “To change” page, and they remain there until they really are different.
-
The personal vault isn’t lost
If recovery is on, the leaver’s personal vault and the vaults they alone managed pass to a colleague. Without a transfer, only that person had them.
-
Recipients know what they get
The recipient will see all the leaver’s passwords, notes and codes, and the entries arrive marked to change. You confirm this explicitly before requesting the transfer.
-
The custodian is a recorded access
To transfer, a custodian holds the person’s key: that is an access. It stays on record, administrators and custodians are notified, and the recipient then changes the key of every vault.
-
A clear deadline: 30 days
30 days after deactivation the person’s keys are deleted, always. For each departure you see the days left: whatever hasn’t been transferred by then is lost.
Frequently asked questions
If I remove access, do I still have to change the passwords?
Yes. Removing access stops them opening the vaults, but anyone who has seen a password knows it, and anyone who can read an entry can also copy it. Kamzan Pass prepares the list; the passwords have to be changed on the sites.
Does the report say which passwords they opened?
Not with certainty. It says which entries they could see and which their devices declared opened. A modified app can stay silent, and someone who exports without declaring it appears never to have opened it: declarations only help you decide where to start.
What if recovery is off?
The transfer can’t be done, because it only goes through recovery: the leaver’s personal vault is lost, along with the vaults they alone managed. That’s why it’s worth deciding beforehand, not on the day they leave.
What if the person comes back?
If you give access back before the deadline, they have to be invited to the shared vaults again. After the deadline, their keys and personal vault can no longer be recovered, unless the vault was transferred first.
The other Kamzan Pass features
Want to see it before it arrives?
We show you Kamzan Pass on a test vault: how a password is shared, what happens when someone leaves the company and what the server doesn’t see. Half an hour, no strings attached.
Alex