Organisation recovery
The organisation recovery key is an optional org-level key pair. When it’s enabled, every request envelope is also sealed to it — so an Owner can recover a credential even if the technician who received it has lost every unlock method.
It’s the answer to one question: what happens if a technician loses their key while a credential they received is still needed?
The trade-off
Section titled “The trade-off”This is a genuine security decision, and it’s yours to make:
- On — nothing is lost when a technician loses their key or leaves; an Owner can break glass. This is why it’s recommended for MSPs, who hold clients’ credentials and answer to audits.
- Off — no single org-held key can ever decrypt a credential. Maximum zero-knowledge, but a lost key means the credentials that were sealed only to it are unrecoverable. Suited to a strict single team that accepts that.
You choose at setup, and it’s always optional. Recipients are visible on every request either way, so recovery is never hidden.
If your organisation has no organisation recovery key three days after it was created, its Owners get one reminder by email and in the app (Set up your organisation recovery key). You can turn that email off under Setup reminders on your profile.
Without it, when a technician starts over after losing their recovery phrase and every passkey, credentials sealed only to their old key are lost. With it, an Owner can still open them from each request’s page with Recover with org key. The recovery key keeps working when the Owner who set it up starts over: nothing needs signing again.
Enabling it (the ceremony)
Section titled “Enabling it (the ceremony)”Enabling org recovery is a deliberate ceremony run by an Owner:
- An Owner starts the ceremony from Settings → Policy → Organisation recovery key → Set up.
- SafeHanded generates the recovery key pair in the browser.
- The recovery phrase (24 words) is displayed once. Print it or store it offline securely — SafeHanded never keeps a usable copy.
- Confirm you’ve stored it. Your browser signs the new key with your own signing key, and from now on new envelopes are also sealed to it.
Technicians’ browsers seal to the recovery key only when an Owner’s signature on it checks out (see How keys are checked). A key set up before signatures existed shows Sign the recovery key on this page; until an Owner signs it, it is left out of new requests. The email every Owner gets when the key changes includes its fingerprint: check it matches the page.
Break-glass: recovering a credential
Section titled “Break-glass: recovering a credential”- An Owner opens the request and chooses Recover with org key. This requires the Owner role, a passkey step-up, and the org recovery phrase typed in (an older 26-character code still works; the page prompts you to rotate the key to get a 24-word phrase).
- Every Owner and Admin is alerted by email and in-app, and the event is written to the audit log with a justification.
- The envelope is unsealed with the recovery key in the browser, and the standard reveal UI opens.
Break-glass is intentionally noisy — it can’t be done quietly.