Skip to main content

Corporate security: where should passwords live?

If the passwords for your banks, servers, and social accounts live in an Excel sheet, in iPhone notes, or in Telegram’s “Saved Messages” chat — your business is at risk.

At 1it.pro we implement security standards that protect against leaks while still being practical for your team. We recommend Vaultwarden (a corporate password manager).

Why are Excel and Telegram a bad fit?​

  1. No encryption: An Excel file can be copied to a flash drive and opened at home.
  2. No access control: If you give the file to an employee, they can see all passwords, including the ones they do not need.
  3. Inconvenient: When someone leaves the company, you have to change every password manually, because you do not know what they saved.

What is Vaultwarden?​

Vaultwarden is a lightweight, fast version of the popular password manager Bitwarden, deployed on your server.

Think of it as your private digital safe.

Benefits of a self-hosted solution​

  • Full control (GDPR): Your password database does not live in the cloud of a US corporation. It lives on your server in Europe, under your control.
  • Free premium features: Unlike paid SaaS tools (1Password, LastPass), Vaultwarden is free and supports premium features (TOTP, file attachments, YubiKey).
  • Cross-platform: Works everywhere — iOS, Android, Windows, Mac, Linux, browser extensions.

Organizing access: Collections​

The key business feature is Collections (Groups). You do not give passwords to people — you give people access to Collections.

Example structure:

  • 📂 Marketing: Access to Instagram, Facebook Ads, Google Analytics. (Access: Marketer, CEO).
  • 📂 Development: Access to Hetzner hosting, GitHub, Cloudflare. (Access: CTO, developers).
  • 📂 Accounting: Banks, tax authority. (Access: Accountant, CEO).
  • 📂 Admin: Administrator passwords. (Access: CEO only).

Scenario: The marketer leaves? You simply disable their account in Vaultwarden. Access to all services disappears instantly. No panic, no manual reset of 50 passwords.

Digital hygiene: password change rules​

There is a myth that passwords must be changed every 30 or 90 days. Modern security standards (NIST) say the opposite.

1. How often should passwords change?​

Answer: only if there is a suspicion of compromise.

Frequent password changes are harmful: people start inventing simple patterns (Password1, Password2, Password3) that are easy to crack.

Best practice:

  • Create one very strong and long password (20+ characters) once.
  • Use a password generator.
  • Never memorize it yourself (let Vaultwarden remember it).

2. Two-factor authentication (2FA)​

This is mandatory. Even if a hacker learns your password, they cannot log in without the code from the app. Vaultwarden can generate 2FA (TOTP) codes itself — you do not need Google Authenticator on your phone; the code is filled in automatically in the browser.

3. Master password​

The only password you must remember is the Master Password for Vaultwarden itself.

  • Make it a phrase. For example: I-love-coffee-in-Warsaw-morning-2024!.
  • Important

    If you forget the Master Password, we cannot recover it. The data is encrypted in a way that turns it into digital garbage without this key. Write it on paper and keep it in a real safe.

How do we implement it?​

  1. Deployment: We install Vaultwarden on a protected subdomain (for example, vault.your-company.com).
  2. Setup: We close access from the outside and allow login only through VPN or IP allowlists (optional).
  3. Backups: We set up automatic encrypted backups of the password database.
  4. Training: We show the team how to use the browser extension.

🚀 Where do you start?​

  1. Install the Bitwarden app on your phone and computer.
  2. In the settings, choose "Self-hosted" and enter the server address we give you.
  3. Start moving passwords out of Excel.