VaultSort Business · Guide
Organization Recovery
Hardware-key encryption is only safe for a firm if the firm can still get in when a key is lost or its owner leaves. Organization Recovery gives your firm its own key to what your staff encrypt, held by you, not by us, and with no server in between.
How it works
1
The firm has its own key
An administrator creates the organization’s recovery key on their computer. It is locked behind their YubiKey, and a printed recovery sheet kept in the firm’s safe. VaultSort never sees it.
2
Every computer adds one more lock
Computers that join the organization give every Vault they open, and everything they encrypt with a security key, one extra slot, locked to the organization’s public key. Nothing changes for the person using it.
3
Only the firm can open that lock
The slot opens with the organization’s key and nothing else. Your staff’s own keys keep working as before. If one is lost, or its owner leaves, the firm still gets in.
Under the hood: each slot wraps the file’s key to the organization’s X25519 public key (the key-encapsulation method from RFC 9180), then with AES-256 key wrap, the same wrap every other VaultSort slot uses. The organization’s policy is signed with Ed25519 and identified by a fingerprint of both its public keys.
For the administrator
Once, on your own computer. You need VaultSort Business and a YubiKey (or two).
Create the organization
Open YubiKey Settings › Organization and choose Create an organization. Name it, choose the security keys that open the organization key and touch each one. Two keys held by two different people is safest.
Print the recovery sheet
VaultSort shows the recovery sheet’s code once. Print it, put it somewhere safe and offline, such as the firm’s safe, and confirm it is stored.
Choose what is covered
Files, folders and Vaults can each be covered or not. You can also turn off password encryption on members’ computers, so that every file and folder they encrypt in VaultSort is recoverable. You can change either later by issuing an updated policy.
Export the policy for your team
Choose Export policy for your team. The policy file contains only public information, so you can email it. Tell your team its fingerprint by a separate route: in person, by phone or in a chat they already trust.
Save a backup of the organization key
Choose Save a key backup and keep the copy apart from this computer. The file is sealed: it opens only with one of its security keys or the recovery sheet.
For everyone else
On each computer in the firm. It takes a minute.
Update VaultSort
Every computer needs VaultSort 5.8 or later before it joins. VaultSort tells you if the policy needs a newer version.
Join with the policy file
Open YubiKey Settings › Organization, choose Join with a policy file and pick the file your administrator sent.
Check the fingerprint
VaultSort shows the organization’s name and fingerprint. Compare the fingerprint with the one your administrator gave you, then confirm. This is the step that makes sure the policy really is your organization’s.
Cover your older files
Files you encrypted before joining aren’t covered yet. Choose Add organization recovery to a folder… and VaultSort adds it to the encrypted files there, one security-key touch per key. Vaults are covered the next time you unlock them.
Recovering files
Files and folders
On the administrator’s computer, open YubiKey Settings › Organization › Recovery console and choose Open organization key, with one of its security keys or the recovery sheet. Then choose Recover files and pick the encrypted files. Decrypted copies are saved next to the originals; the originals are left as they are.
A Vault
With the organization key open, choose the Vault’s folder on the Vault page, then Unlock with organization key on its lock screen.
On a different computer
Install VaultSort, open YubiKey Settings › Organization and choose Import organization key with your backup copy. Then open it with the recovery sheet. None of this needs a licence: getting into your own files never does.
The organization key closes itself
After 10 minutes without use, or when you choose Close organization key. Every opening, recovery and change is written to the recovery record on that computer.
What it covers
- Files and folders encrypted with a security key (YubiKey, Touch ID or Windows Hello) on a computer that has joined
- Vaults on that computer, however they are unlocked (password, Touch ID, Windows Hello or a YubiKey), once they’ve been created or unlocked there after it joins
- Older encrypted files, once you add organization recovery to them
What it doesn’t
- Individual files encrypted with a password. That format has no room for a second lock; VaultSort says so on the Encrypt card. (A Vault opened with a password is covered, and your administrator can turn password encryption off.)
- Files encrypted on a computer that has not joined, or before it joined, until organization recovery is added to them.
- Anything a person deliberately keeps from the firm. Someone with administrator rights on their own computer can leave the organization or encrypt elsewhere. This is a way back in, not a monitoring tool.
Questions
Can VaultSort open our files with the organization key?
No. The organization key is created on your administrator’s computer and never leaves it except as the sealed backup you save. VaultSort, the company, has no copy and no way to get one. There is no server involved.
What happens if we lose the administrator’s YubiKey?
Open the organization key with the printed recovery sheet instead, then add a new security key in YubiKey Settings › Organization. That is why the sheet matters: keep it somewhere safe and offline, away from the computer.
What if we lose the YubiKeys and the recovery sheet?
Then the organization key cannot be opened, by you or by anyone else, and what only it could open stays locked. Each person’s own keys still open their own files. Keep two administrator keys and the sheet in separate places.
Does joining slow anything down or change how people work?
No. Encrypting and opening files works exactly as before. The Encrypt card simply says which organization can also recover what you’re about to encrypt.
Can we stop staff encrypting files with a password?
Yes. When you create the organization, or issue an updated policy, choose Turn off password encryption on members’ computers. VaultSort then encrypts files and folders on those computers only with a security key, so everything encrypted in VaultSort is recoverable, and the Encrypt card says why. It can’t stop other software, and Vaults and password-protected copies made to send to clients aren’t affected.
Can someone remove the organization’s lock from a file?
Not from inside VaultSort: the organization’s slot isn’t listed among a person’s own unlock methods, and a Vault refuses to have it removed. Someone determined could decrypt a file and re-encrypt it on a computer that hasn’t joined. Organization Recovery protects the firm against lost keys and departures, not against deliberate concealment.
Is there a log of when files were recovered?
Yes. The recovery console keeps a record on the administrator’s computer of each time the organization key was opened, used or changed, and you can export it as a spreadsheet. It is a record, not a tamper-proof audit log: it lives on that computer and its administrator can edit it.
Does this make us compliant with HIPAA or GDPR?
No software does that on its own, and VaultSort makes no such claim. Organization Recovery gives your firm a way back into its own encrypted files; how that fits your obligations is for your own policies and advisers.
What if our Business plan lapses?
Computers that have joined keep adding the organization’s lock, and the recovery console keeps working: your access to your own files never depends on a licence. Joining new computers and changing the organization key need an active plan.
Can older versions of VaultSort open files that have the organization’s lock?
No. Files, folders and Vaults written by a computer that has joined need VaultSort 5.8 or later to open, on any computer. Update everyone before they join.
Included in every Business plan
Organization Recovery comes with VaultSort Business, alongside everything in Premium on every computer. Every plan starts with a 30-day free trial.