Business continuity

Every company has a short list of credentials that are not in any password manager because they are the ones that open the password manager. The root account of the cloud provider. The registrar where the domain lives. The certificate used to sign releases. The recovery codes of the billing account.

They usually end up in one of two places, and both are bad: one person’s head, or a shared document that half the company can open.

The problem has a name

If one person holds them, the company depends on that person being reachable, willing and alive. It is not a theoretical risk: people leave badly, get sick, and go on holiday somewhere with no signal in the same week the certificate expires.

And if everyone holds them, there is no control at all: any single person can act alone, and any single leak is total.

Two signatures, like the bank account

Nobody finds it strange that a company transfer needs two signatures. The same rule applied to credentials is exactly what ShamirVault does: split the secret into parts and require several of them together.

• Three parts held by three people, any two of which recover the account. One person alone cannot; two can.
• Or by groups: the technical team counts as one group, management as another, and any two groups recover it.
• One part deposited with the company’s lawyer, which turns a technical decision into a documented one.

What happens when someone leaves

This is where it pays for itself. When the person holding a part leaves, you do not have to rotate every credential in a hurry: their part on its own is worthless, and the rest of the group can rebuild the secret and split it again without that person. The offboarding checklist stops being an emergency.

And it leaves a paper trail

The annual plan generates a printable record of the split: what was split, when, with what threshold, and a line for each person to sign as they receive their part. Plus instructions written for whoever has to use it — who will not be the person who set it up, and will be reading them at a bad moment.

Where to start

Take the shortest list you have: the credentials that would stop the company if they were lost tomorrow. Usually there are three or four. Split those first. Everything runs on the device, nothing you type reaches us, and there is no account to create.