“What if I forget my password?” is the most honest question buyers ask about zero-knowledge vaults. Marketing that dodges it is usually hiding key escrow.
This guide explains the master-password and recovery tradeoff for business document vaults—so security and legal can choose a model that matches their threat model, not a slogan.
The uncomfortable triangle
- Operator cannot read files
- User can lose the secret
- Someone can still recover
Pick any two. Products that claim all three are either imprecise or holding recoverable keys. For definitions, start with what zero-knowledge means and who holds the keys.
Recovery patterns ranked by custody honesty
1. User-held recovery key / backup codes
Compatible with client-held keys. Operational duty: store codes offline, rotate on staff change, never paste into Slack.
2. Organization-controlled multi-party recovery
Threshold schemes or dual-control unwrap. Strong for enterprises that can run the ceremony; weak if “break glass” is one admin in practice.
3. Vendor-assisted reset
Convenient. Implies the vendor can help reconstruct access—document the escrow clearly in RFPs.
Operational checklist for client-held vaults
- Issue recovery materials at account creation—not after a lockout
- Store recovery secrets in your enterprise password manager as a labeled emergency item
- Test restore on a non-production packet once a year
- Revoke and re-issue recovery materials when owners leave
- Answer questionnaires with precision—see encryption questionnaire answers
Compliance Locker follows a client-held key model: the operator cannot decrypt customer document plaintext under normal operation. Plan recovery as a user/org control—not a forgotten-password email.
What not to do
- Share one master password across the legal team
- Store the only recovery PDF exclusively in the vault it unlocks
- Assume “SSO login” means the vendor can reset vault crypto keys
- Buy based on AES-256 logos without asking about recovery escrow
FAQ
Can a true zero-knowledge vendor reset my master password?
Not without breaking the model. If they can restore vault plaintext after a forgotten password alone, they hold recoverable key material—ask how that escrow works.
Is that a bug?
No. It is the tradeoff: operator blindness versus frictionless recovery. Choose consciously for the document classes you store.
What recovery options are compatible with client-held keys?
User-held recovery keys, printed backup codes, hardware-backed secrets, or multi-party recovery schemes you control—not a vendor ‘email me a reset link’ that unwraps the vault.
Should every employee have their own vault password?
Prefer individual accounts and organization policies over a shared master password in 1Password titled ‘the vault.’ Shared masters recreate the Drive password problem.
How do we answer this on questionnaires?
State recovery implications honestly. See our guide on security questionnaire encryption answers for claim-safe wording.
Related: Zero-knowledge for business documents, Security overview.